guenther at rudersport
May 14, 2008, 2:44 PM
Post #8 of 18
(236 views)
Permalink
|
On Thu, 2008-05-15 at 09:09 +1200, Kathryn Kleinschafer wrote:
>
> Pastebin for email: http://pastebin.ca/1018368
> Pastebin for spam check results: http://pastebin.ca/1018373
OK. And what about my questions above? Err, wait, they are actually
below your reply. ;)
> Karsten Bräckelmann wrote:
> > On Wed, 2008-05-14 at 16:25 +1200, Kathryn Kleinschafer wrote:
> >
> >> which seems to me that it is actually loading up the correct files - yet
> >> when i do a test on a piece of mail which should hit heaps of rules
> >> especially the sought_rules it is not hitting at all.
> >> Are there any other tests I can do?
> >
> > How do you tell the Sought rules should hit? If used correctly, they are
> > a moving target. [1]
Why do you believe it should hit the Sought rules?
> > Also, can you elaborate on "not hitting at all"? Including the actual
> > results, the SA headers, would be a good start. And maybe put a sample
> > up a pastebin.
Oh, yeah, definitely. Please do elaborate on your definition of "not
hitting at all". Usually implies no rules hit, and often that SA didn't
even process the message. Which it did in this case.
OK, just checked locally. Scores 8.6 (that's without the munged To) for
me. Granted, it hits a couple custom rules. :)
However, it *indeed* hits Sought (as of 3 hours ago!), plus URIBL_BLACK.
* 3.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
* [URIs: lm6xv9muv93y98.blogspot.com]
* 2.0 JM_SOUGHT_3 JM_SOUGHT_3
Please do note again, that you need to keep the Sought rules updated.
See the docs. [1] If you don't, I'm not impressed by them not hitting.
The entire purpose of Sought is, to catch recent, changing phrases in
low scoring spam.
FWIW, the default JM_SOUGHT_* score is a whopping 4.0.
For URIBL_BLACK to hit on this kind of throw-away addresses, you need to
tweak your conf:
util_rb_2tld blogspot.com
Other than that, it hits better on Bayes for me. Plus custom rules
involving blogspot.com addresses in general, and such addresses in mail
directly delivered by the MUA to MX.
HTH
guenther
[1] http://wiki.apache.org/spamassassin/SoughtRules
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
|
