Re: Howto AND-combine several tests in a single rule?
On Tue, 2009-07-07 at 14:33 +0200, Peter Daum wrote:
> Just for clarification:
>
> - I guess, your answer implies that the only way to write a rule where each
>of several tests must match is via such a "meta" rule? (i.e. there is no
>way to write a "regular" rule with multiple tests that must all match)
>
That's the most general way. However, the hidden rules can be added:
meta RX ((__r1 + __r2 + __r3) > 2.0)
as the easiest way of saying that any two or three subrules must fire to
trigger the meta. You can often generalise phrases:
/(account|personal|enter).{1,30}information/i
but this may not solve the problem because it implies some sort of
textual ordering which is never implicit in a meta rule.
Its often useful to develop a rule without the underscores so you can
see what is firing, e.g. I have an MG_MONEY rule that recognises
monetary amounts and scores them as 0.1 and a MG_SF to recognise
Sourceforge mailing lists and scores them as 0.01. They also get used as
components in a meta to deliver an extra kicking, for instance terms
that appear in medical spam may be innocuous by themselves, but several
of them in combination mean spam.
> - there is nothing specific to "hidden tests" (i.e. tests whose name starts
>with 2 underscores) about the meta rule mechanism, so meta rules can
> arbitrarily
>combine any other rules
>
Correct.
> - whereas "hidden" tests are only useful for meta rules (when I prepend "__"
> to
>the name of some other rule, it is not only hidden, but also ends up with
> a
>score of 0, even if there is some other score explicitly assigned)
>
No, I think it carries a score of 1 (or the addition trick wouldn't
work) but 'hidden' rules don't get added into the overall score.
Martin
Re: Howto AND-combine several tests in a single rule?
On Tue, 07 Jul 2009 14:33:12 +0200 Peter Daum wrote: > - whereas "hidden" tests are only useful for meta rules (when I > prepend "__" to the name of some other rule, it is not only hidden, > but also ends up with a score of 0, even if there is some other score > explicitly assigned) That's not really it. If you don't specify a score, an ordinary rule is automatically scored at 1 point; and if you manually score it at 0, it doesn't run. A hidden rule automatically scores 0, and still runs.
Re: Howto AND-combine several tests in a single rule?
Martin Gregorie wrote: You need double underscores to make a rule invisible. ... oops - I had overlooked on the web page, that this is _2_ underscores (and was pretty puzzled to discover that w/o assigning a separate score to each single test they will be ignored ;) - Thanks a lot! Just for clarification: - I guess, your answer implies that the only way to write a rule where each of several tests must match is via such a "meta" rule? (i.e. there is no way to write a "regular" rule with multiple tests that must all match) - there is nothing specific to "hidden tests" (i.e. tests whose name starts with 2 underscores) about the meta rule mechanism, so meta rules can arbitrarily combine any other rules - whereas "hidden" tests are only useful for meta rules (when I prepend "__" to the name of some other rule, it is not only hidden, but also ends up with a score of 0, even if there is some other score explicitly assigned) Is this correct? Regards, Peter
Re: Howto AND-combine several tests in a single rule?
On Tue, 2009-07-07 at 09:43 +0200, Peter Daum wrote: > Is there a simpler and better way to specify that all tests in a rule > have to match? (or, just for symmetry, to say that a test should > not match)? > describe RULE Combined tests header__R1 From=~/something/ header__R2 User-Agent=~/something else/ meta RULE (__R1 && __R2) score RULE 2.0 You need double underscores to make a rule invisible. There is a convention of prefixing a local rule name with your initials, e.g. PD_RULE. I think that is a good convention because it makes your rules easier to recognize and also groups them together (rules lists in X-Spam headers are sorted alphabetically). Martin
