Rulesets

[Julian Field]

At 14:36 20/03/2003, Michael Forrest wrote:

>Thanks Julian as always :-)
>
>Will that spamlist variable in the code include RAZOR2?

No.

>  or will i have to
>parse the output returned back from SA for any "RAZOR2_" tags?

Yes, you could do
   my $spamlist = $message->{isrblspam};
   $spamlist  = 1 if $message->{spamreport} =~ /RAZOR2/;


>Mar 20 14:03:09 mail.erg.abdn.ac.uk MailScanner[29811]: Message
>h2KE2snL001370 from 216.95.201.40
>(cid=1-uid=25805950-mid=989-- at bounce.jsuati.com) to erg.abdn.ac.uk is spam,
>SpamAssassin (score=28.9, required 5, ADVERT_CODE, BAYES_90, CLICK_BELOW,
>EXCUSE_1, EXCUSE_19, EXCUSE_24, GUARANTEED_STUFF, HTML_40_50,
>HTML_LINK_CLICK_HERE, HTML_TAG_EXISTS_TBODY, HTML_WEB_BUGS, MARKETING_PARTNERS
>, NO_COST,OFFER, OFFERS_ETC, RAZOR2_CF_RANGE_91_100, RAZOR2_CHECK,
>RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_NJABL, RECEIVE_OFFER,
>REMOVAL_INSTRUCTIONS, REMOVE_IN_QUOTES, REMOVE_SUBJ, SATISFACTION,
>SUBJ_ALL_CAPS)
>
>Thanks,
>
>Michael
>
>
>On Thu, 20 Mar 2003, Julian Field wrote:
>
> > This is a perfect use for a Custom Function.
> >
> > Set these in your MailScanner.conf file
> >
> > Required SpamAssassin Score = 5
> > Spam Actions = &SpamActions
> > High SpamAssassin Score = 20
> > High Scoring Spam Actions = delete
> >
> > That handles the score>20 situation for you.
> >
> > So you would have something like
> >
> > sub SpamActions {
> >    my($message) = @_;
> >
> >    return 'deliver' unless $message; # Sanity check in case something went
> > wrong
> >
> >    my $score = $message->{sascore};
> >    my $spamlist = $message->{isrblspam};
> >
> >    return 'bounce delete' if $score>=10 && !$spamlist;
> >    return 'delete' if $score>=10;
> >    return 'deliver';
> > }
> >
> > That code goes in CustomConfig.pm by the way.
> >
> > At 13:12 20/03/2003, you wrote:
> > >Hi All,
> > >
> > >At the moment we use a "Required SpamAssassin Score" of 5 and a high
> > >setting of 10 (which we bounce,delete). But over the past few months the
> > >mail queues have been building up substantially with deferred connections
> > >which are all bounces to real spam email and not false positives.
> > >
> > >I was wondering if it was possible to change the behaviour slightly, in
> > >such a way as to use more than just the raw SA score. For example :-
> > >
> > >         SA Score >20                       - delete
> > >         SA Score >10 AND NOT in SpamList   - bounce,delete
> > >         SA Score >10 AND in SpamList       - delete
> > >         SA Score >5                        - Mark as {Spam?}
> > >
> > >Spam List being ORDB-RBL Infinite-Monkeys and RAZOR(I realise SA does
> > >the RAZOR check:-()....
> > >
> > >Any thoughts? or am i looking at this from the wrong angle. Could you cc
> > >my address in the reply, since i'm currently set to digest mode for the
> > >list group and would not see replies till midnight :-(
> > >
> > >Thanks,
> > >
> > >Michael.
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > MailScanner thanks transtec Computers for their support
> >
> >

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support