On Wed, 2011-03-02 at 07:46 -0800, tr_ust wrote:
> I'm sorry - there's only one line in the sample of how to write a uri rule.
>
> Are you saying that for each line I need to create a unique
> "LOCAL_URI_EXAMPLE" line? In other words it should look more like this?
>
> uri LOCAL_URI_EXAMPLE /03ysl.9hz.com/
> core LOCAL_URI_EXAMPLE 20
>
> uri LOCAL_URI_EXAMPLE_1 /03ysl.9hz.com/
> core LOCAL_URI_EXAMPLE_1 20
>
> uri LOCAL_URI_EXAMPLE_2 /03ysl.9hz.com/
> core LOCAL_URI_EXAMPLE_2 20
>
> Would that be correct?
>
Short answer, yes.
Reason: every rule needs a unique name.
Longer answers:
(a)You can combine rules by using a more complex regular expression
(aka regex):
describe MULTI_MATCH Example rule to match several URIs
uri MULTI_MATCH /(03ysl.1ab.com|03ysl.5zz.com|03ysl.9ml.com)/
score MULTI_MATCH 20
and if the regex extends over more than one line you can use
meta-rules to OR them together.
(b) I use a number of large regexes (25 terms on average, min 2 terms,
max over 200 terms) and wrote a script, portmanteau, that assembles
a rule from a file containing a list of terms. Its a bash script
wrapper round an awk/gawk script.
If that sounds useful, you can find the portmanteau script here:
http://www.libelle-systems.com/free/
You don't need to know Perl to write good Spamassassin rules but you do
need to be able to read and create Perl regular expressions.
Martin
>
> Karsten Bräckelmann-2 wrote:
> >
> > On Tue, 2011-03-01 at 13:11 -0500, Bowie Bailey wrote:
> >> On 3/1/2011 12:39 PM, tr_ust wrote:
> >> > Thanks...I could really use the help!
> >
> > [...]
> >> > uri LOCAL_URI_EXAMPLE /03ysl.9hz.com\//
> >> > score LOCAL_URI_EXAMPLE 20
> >> > uri LOCAL_URI_EXAMPLE /040jk.9hz.com\//
> >> > score LOCAL_URI_EXAMPLE 20
> >> > uri LOCAL_URI_EXAMPLE /0oczg.9hz.com\//
> >> > score LOCAL_URI_EXAMPLE 20
> >> >
> >> > I'm using the per user option right now for spamassassin, so I test it
> >> by
> >> > sending the user an email with one of these links...and it's still
> >> going
> >> > through.
> >>
> >> You are aware that these rules are specifying that there MUST be a slash
> >> after .com in order to match, right?
> >>
> >> Other than that, I don't see any obvious problem. Send an example email
> >> through your system and put the resulting email (with headers) into a
> >> pastebin so I can look at it.
> >
> > Uhm... There is only ONE rule. Repeatedly overwriting the previous rule
> > definition. Last one is defined, everything prior to that is effectively
> > non-existent.
> >
> > Does that count as obvious problem? ;)
> >
> >
> > --
> > char
> > *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
> > main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8?
> > c<<=1:
> > (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0;
> > }}}
> >
> >
> >
>
