X-PerlMx-Spam: Gauge=XXXXXXXXXIIIII, Probability=95%,
<snip>
header LOCAL_PERLMX_TAG X-PerlMX=~ /\bGauge=XXXXXXXXX\b/i
score LOCAL_PERLMX_TAG 3
In this case, the second \b will hurt you. It won't match because there's a bunch of I's after the last X.
(\b requires there to be something that's not alphanumeric or an underscore there, and is intended to match breaks between words, without regards for if it's a whitespace or some kind of punctuation)
There's also no reason to make it case insensitive, so drop the /i at the end.
I'd also name it to point out that this rule will fire only if the "spam probability" is 90% or greater. (each X is 10% probability)
header LOCAL_PERLMX_TAG_90 /X-PerlMX=~ /\bGauge=XXXXXXXXX/
You could do one with 8'x for 80 or higher, but realize that a 90% will trigger both rules, not just the 90, so you'd have to adjust the scores to reflect that they add up.
You can also create them to grab the "probability" part instead of the XX's.. this would make it easier to do ranges of 10 percent each which don't overlap, so you'd not need to add scores.
header LOCAL_PERLMX_TAG2_90 /X-PerlMX=~ /\b Probability=9[0-9]\%/ header LOCAL_PERLMX_TAG2_80 /X-PerlMX=~ /\b Probability=8[0-9]\%/ header LOCAL_PERLMX_TAG2_70 /X-PerlMX=~ /\b Probability=7[0-9]\%/
etc..
It looks like the output of a bayes system, so 50% should (theoretically) be the spam/nonspam breakover point.
------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
