HI, I have an FP that has hit on a few rules, but one of them was a rule for short URLs, but I can't figure out which one it's hitting. How can I have it show me which pattern triggered a specific rule?
It seems some rules already show this, for example: Jan 10 19:38:29.919 [2393] dbg: rules: ran rawbody rule __BUGGED_IMG ======> got hit: "<img src="http://emanage1.com/open.php"; but my rule doesn't. I've run SA as "spamassassin -t -D < myfp" and below is the rule: body __RB_GT_200 /^.{201}/s meta __BODY_LE_200 (__RB_LE_200 == 1) && !__RB_GT_200 meta __RB_LE_200 !__RB_GT_200 # less or equal IFF not greater mimeheader __MIME_IMAGE Content-Type =~ /^image\/./ mimeheader __MIME_ATTACH Content-Disposition =~ /^attachment/ meta LOC_SHORT ((__BODY_LE_200 && __HAS_HTTP_URI) && (!(__MIME_IMAGE || __MIME_ATTACH || BAYES_00 || USER_IN_WHITELIST || KHOP_RCVD_TRUST))) describe LOC_SHORT Has URI and short body score LOC_SHORT 1.1 The false-positive is here http://pastebin.com/yRbH3fWr Thanks so much, Alex
