On 26.09.17 12:20, Luca Bertoncello wrote:
I'm trying to write some rules to merge Kaspersky with SpamAssassin...
Kaspersky saves the result in the header X-KLMS-AntiSpam-Rate, so I
wrote in my local.cf this:
header KLMSSPAM_LT10 X-KLMS-AntiSpam-Rate =~ /^([0-9]{1})$/
describe KLMSSPAM_LT10 E-Mail has less than 10% probability to
be Spam according to Kaspersky
score KLMSSPAM_LT10 0.0
header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^([012]{1})([0-9]{1})$/
describe KLMSSPAM_1030 E-Mail has 10-30% probability to be
Spam according to Kaspersky
score KLMSSPAM_1030 0.5
header KLMSSPAM_3060 X-KLMS-AntiSpam-Rate =~ /^([345]{1})([0-9]{1})$/
describe KLMSSPAM_3060 E-Mail has 30%-60% probability to be
Spam according to Kaspersky
score KLMSSPAM_3060 1.5
header KLMSSPAM_6090 X-KLMS-AntiSpam-Rate =~ /^([678]{1})([0-9]{1})$/
describe KLMSSPAM_6090 E-Mail has 60%-90% probability to be
Spam according to Kaspersky
score KLMSSPAM_6090 2.0
header KLMSSPAM_90 X-KLMS-AntiSpam-Rate =~
/^([9]{1}|[10]{2})([0-9]{1})$/
describe KLMSSPAM_90 E-Mail has more than 90% probability to
be Spam according to Kaspersky
score KLMSSPAM_90 3.0
Unfortunately, it doesn't work...
__SOMETIMES__, really random!, the rule KLMSSPAM_90 will be used, but
in that case I see in the E-Mail:
X-KLMS-AntiSpam-Rate: 0
Could someone help me and say what am I doing wrong?
at first I'd recommend avoid those {1} and skip useless ()
at second, 1030, 3060, and 6090 should be named 1029, 3059 and 6089
header KLMSSPAM_0X X-KLMS-AntiSpam-Rate =~ /^[0-9]$/
header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^[012][0-9]$/
header KLMSSPAM_3060 X-KLMS-AntiSpam-Rate =~ /^[345][0-9]$/
header KLMSSPAM_6090 X-KLMS-AntiSpam-Rate =~ /^[678][0-9]$/
at third, the last rule should be rewritten, the {2} does not what you
apparently means it does:
header KLMSSPAM_90 X-KLMS-AntiSpam-Rate =~ /^(?:9[0-9]|100)$/
should do what you expect.
at fourth, don't you believe kaspersky enough to give first rules small
negative score?
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Fucking windows! Bring Bill Gates! (Southpark the movie)
