I've got a weird situation going on with some rules I'm testing. I'm trying to set up rules to catch various combinations of the real names (and nicknames) of my users. (Not all of this information is found in the /etc/passwd GECOS field, and I have few enough users that I can do this by hand.)
In particular, I want to catch use of their "real name" info in the Subject:, or capitalized versions in the body. For easy testing, I'm supposing just one user, a Mr. Foobar Wombat. My rules to catch things are as follows:
header SUBJ_FOOBAR_TEST Subject =~ /\b([Ff]oobar|[Ww]ombat)\b/ describe SUBJ_FOOBAR_TEST Subject: includes Mr. Foobar Wombat's real name. score SUBJ_FOOBAR_TEST 0.1
header SUBJ_FOOBAR_CAPS Subject =~ /\b(FOOBAR|WOMBAT)\b/
describe SUBJ_FOOBAR_CAPS Subject: includes Mr. Foobar Wombat's real name in CAPS.
score SUBJ_FOOBAR_CAPS 0.1
body FOOBAR_CAPS /\b(FOOBAR|WOMBAT)\b/ describe FOOBAR_CAPS Includes Mr. Foobar Wombat's real name in CAPS. score FOOBAR_CAPS 0.1
Now, when I send an email with "FOOBAR" or "WOMBAT" in the Subject: line, I get back the following:
To: [EMAIL PROTECTED]
From: Kai MacTane <[EMAIL PROTECTED]>
Subject: Mail for Mr. WOMBAT
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
X-Spam-Status: No, hits=0.2 required=4.0
tests=FOOBAR_CAPS,SUBJ_FOOBAR_CAPS
version=2.55-surehand002
X-Spam-Checker-Version: SpamAssassin 2.55-surehand002 (1.174.2.19-2003-
05-19-exp)This one should only trigger the subject caps rule; why does it also hit the body rule?
I don't understand why this is happening. Why should the FOOBAR_CAPS rule -- a body rule -- be triggering at all?
Running "spamassassin --lint" just gives me back a prompt with no output; I assume this means it has nothing to complain about. I have restarted spamd.
--Kai MacTane
----------------------------------------------------------------------
"Soft and only you, lost and only you,
Strange as angels."
--The Cure,
"Just Like Heaven"------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
