On 5 Oct 2017, at 11:21, Richard Nairn wrote:
I am using a rule to detect email with very long links included as I
have seen that those are mostly spam. Some of the messages will
include many copies of the link.
Is there a way to write a meta rule that detects multiple instances of
the same rule?
Quoting the documentation for Mail::SpamAssassin::Conf, from the section
documenting "tflags":
multiple
The test will be evaluated multiple times, for use with meta
rules. Only affects header, body, rawbody, uri, and full tests.
maxhits=N
If multiple is specified, limit the number of hits found to N.
If the rule is used in a meta that counts the hits (e.g.
__RULENAME > 5), this is a way to avoid wasted extra work (use
"tflags multiple maxhits=6").
For example:
uri __KAM_COUNT_URIS /^./
tflags __KAM_COUNT_URIS multiple maxhits=16
describe __KAM_COUNT_URIS A multiple match used to count
URIs in a message
meta __KAM_HAS_0_URIS (__KAM_COUNT_URIS == 0)
meta __KAM_HAS_1_URIS (__KAM_COUNT_URIS >= 1)
meta __KAM_HAS_2_URIS (__KAM_COUNT_URIS >= 2)
meta __KAM_HAS_3_URIS (__KAM_COUNT_URIS >= 3)
meta __KAM_HAS_4_URIS (__KAM_COUNT_URIS >= 4)
meta __KAM_HAS_5_URIS (__KAM_COUNT_URIS >= 5)
