Examples of SpamAssassin Rule Actions

[Julian Field]

On 24/09/2009 09:55, Michael Mansour wrote:
> Hi Julian,
>
> --- On Thu, 24/9/09, Julian Field<MailScanner at ecs.soton.ac.uk>  wrote:
>
>    
>> From: Julian Field<MailScanner at ecs.soton.ac.uk>
>> Subject: Re: Examples of SpamAssassin Rule Actions
>> To: "MailScanner discussion"<mailscanner at lists.mailscanner.info>
>> Received: Thursday, 24 September, 2009, 6:23 PM
>>
>>
>> On 24/09/2009 09:08, Michael Mansour wrote:
>>      
>>> Hi,
>>>
>>> I have a requirement to consider spam which scores
>>>        
>> under the high scoring spam threshold for an individual, to
>> be consider that message high scoring spam.
>>      
>>> I have looked at the "SpamAssassin Rule Actions"
>>>        
>> setting and there's examples of:
>>      
>>> "
>>> # You can also trigger actions on the spam score of
>>>        
>> the message. You can
>>      
>>> # compare the spam score with a number and cause this
>>>        
>> to trigger an action.
>>      
>>> # For example, instead of a SA_RULENAME you can
>>>        
>> specify
>>      
>>> # SpamScore>number or SpamScore>=number or
>>>        
>> SpamScore==number or
>>      
>>> # SpamScore<number or SpamScore<=number
>>> # where "number" is the threshold value you are
>>>        
>> comparing it against.
>>      
>>> # So you could have a rule/action pair that looks
>>>        
>> like
>>      
>>> #
>>>        
>>      SpamScore>25=>delete
>>      
>>> # This would cause all messages with a total spam
>>>        
>> score of more than 25 to be
>>      
>>> # deleted. You can use this to implement multiple
>>>        
>> levels of spam actions in
>>      
>>> # addition to the normal spam actions and the
>>>        
>> high-scoring spam actions.
>>      
>>> #
>>> # Combining this with a ruleset makes it even more
>>>        
>> powerful, as different
>>      
>>> # recipients and/or senders can have different sets of
>>>        
>> rules applied to them.
>>      
>>> "
>>>
>>> But no example of how to actually say:
>>>
>>> "if SpamScore>9=>quarantine for To address of blah at blah.com"
>>>
>>> Is there more details I can find anywhere on the wiki
>>>        
>> or anywhere else on how I can setup the above?
>>      
>>>
>>>        
>> You first need a ruleset to apply the action to just blah at blah.com. So
>> set
>> SpamAssassin Rule Actions =
>> %rules-dir%/spam.rule.actions.rules
>>
>> Then in /etc/MailScanner/rules/spam.rule.actions.rules put
>> this
>>
>> To: blah at blah.com
>> SpamScore>9=>store,not-deliver
>> FromOrTo: default deliver
>>
>> That should do the trick. Do you understand it?
>>      
> Yes that's perfect thanks. I have this now as:
>
> JKF_ANTI_PHISH=>not-deliver,store,forward spam at example.com, header "X-Anti-Phish: Was to _TO_"
>    
If that is in a ruleset, it's missing the "direction" and 
"address-pattern" words at the start of the line, so won't work.
> To: user at example.com SpamScore>9=>store,not-deliver
> FromOrTo: default deliver
>
> and will monitor over the coming days but I trust it will work fine.
>
> Thanks Jules.
>
> Michael.
>
>    
>> Jules
>>      
>
>
>        __________________________________________________________________________________
> Get more done like never before with Yahoo!7 Mail.
> Learn more: http://au.overview.mail.yahoo.com/
>    

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.