Re: tflags
On Thu, 3 Aug 2017, Kris Deugau wrote: Ian Zimmerman wrote: On 2017-08-03 10:38, sha...@shanew.net wrote: The most common ones that I make use of are "multiple" and "maxhits" in order to allow a rule to be scored for each time it hits, but to stop counting after some threshold. I also use the "net" tflag so that RBL checks only run when a net-based ruleset is loaded. Where is the concept of "ruleset" in general documented, and in particular what makes it "net-based"? Not in Mail::SpamAssassin::Conf. "Ruleset" is a somewhat fuzzy term that depends on context - it could refer to a single rule, a cluster of rules in a single file, a group of files, or "all active rules files". It's not a formal definition within SpamAssassin. In this case it's referring to one rule - tflags are only set on a per-rule basis. Any net-based rule is one that relies on a working Internet connection to do a data lookup - most commonly DNS lookups, but rules for eg Vipul's Razor (RAZOR_* rules), DCC, or Pyzor are also considered net rules since they do a lookup against a network service somewhere. More to the point, if you look at the "spamd" documentation for the "-L" flag you'll see: -L, --local Perform only local tests on all mail. In other words, skip DNS and other network tests. Works the same as the "-L" flag to spamassassin(1). So all "net-based" rules (as indicated by intrinsic coding or the tflags 'net') get ignored when running in --local mode. -- Dave Funk University of Iowa College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527 #include Better is not better, 'standard' is better. B{
Re: tflags
Apologies, I should have used the phrase "score set" rather than ruleset. The "score" section of Mail::SpamAssassin::Conf talks about it briefly, as does the this wiki page: https://wiki.apache.org/spamassassin/WritingRules On Thu, 3 Aug 2017, Ian Zimmerman wrote: On 2017-08-03 10:38, sha...@shanew.net wrote: The most common ones that I make use of are "multiple" and "maxhits" in order to allow a rule to be scored for each time it hits, but to stop counting after some threshold. I also use the "net" tflag so that RBL checks only run when a net-based ruleset is loaded. Where is the concept of "ruleset" in general documented, and in particular what makes it "net-based"? Not in Mail::SpamAssassin::Conf. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT CompSci =--+--- All syllogisms contain three lines | sha...@shanew.net Therefore this is not a syllogism | www.ischool.utexas.edu/~shanew
Re: tflags
Ian Zimmerman wrote: On 2017-08-03 10:38, sha...@shanew.net wrote: The most common ones that I make use of are "multiple" and "maxhits" in order to allow a rule to be scored for each time it hits, but to stop counting after some threshold. I also use the "net" tflag so that RBL checks only run when a net-based ruleset is loaded. Where is the concept of "ruleset" in general documented, and in particular what makes it "net-based"? Not in Mail::SpamAssassin::Conf. "Ruleset" is a somewhat fuzzy term that depends on context - it could refer to a single rule, a cluster of rules in a single file, a group of files, or "all active rules files". It's not a formal definition within SpamAssassin. In this case it's referring to one rule - tflags are only set on a per-rule basis. Any net-based rule is one that relies on a working Internet connection to do a data lookup - most commonly DNS lookups, but rules for eg Vipul's Razor (RAZOR_* rules), DCC, or Pyzor are also considered net rules since they do a lookup against a network service somewhere. -kgd
Re: tflags
On 2017-08-03 10:38, sha...@shanew.net wrote: > The most common ones that I make use of are "multiple" and "maxhits" > in order to allow a rule to be scored for each time it hits, but to > stop counting after some threshold. I also use the "net" tflag so > that RBL checks only run when a net-based ruleset is loaded. Where is the concept of "ruleset" in general documented, and in particular what makes it "net-based"? Not in Mail::SpamAssassin::Conf. -- Please don't Cc: me privately on mailing lists and Usenet, if you also post the followup to the list or newsgroup. Do obvious transformation on domain to reply privately _only_ on Usenet.
Re: tflags
The Mail::SpamAssassin::Conf man page includes a section on tflags and their various functions, but generally speaking tflags allow you to alter the way in which a rule is processed. The most common ones that I make use of are "multiple" and "maxhits" in order to allow a rule to be scored for each time it hits, but to stop counting after some threshold. I also use the "net" tflag so that RBL checks only run when a net-based ruleset is loaded. As an example, I have various uri rules to detect emails from questionable journals. Since it's possible that someone might be having a legitimate mail conversation about that journal and share the URL to their site, I want to count how many times the URL appears, so I add a "multiple" tflag for the rule. More appearances means the mail is more likely to be advertising the journal or soliciting articles. On the other hand, once it's been seen eight time (or 15 or whatever), there's a diminishing return on that rule's ability to tell me anything more about the email, so I use "maxhits=8" to keep it from continuing to look for the uri (and to stop scoring additional points). On Thu, 3 Aug 2017, John Schmerold wrote: I don't understand the purpose of tflags. Where is this parameter explained? -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT CompSci =--+--- All syllogisms contain three lines | sha...@shanew.net Therefore this is not a syllogism | www.ischool.utexas.edu/~shanew
Re: tflags
On Thu, 3 Aug 2017, John Schmerold wrote: I don't understand the purpose of tflags. Where is this parameter explained? man Mail::SpamAssassin::Conf Basically it allows setting some per-rule metadata that affects how the rule behaves. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- The United States has become a place where entertainers and professional athletes are mistaken for people of importance. -- Maureen Johnson Smith Long --- Tomorrow: the 282nd anniversary of John Peter Zenger's acquittal
tflags
I don't understand the purpose of tflags. Where is this parameter explained? -- John Schmerold Katy Computer Systems, Inc https://katy.com St Louis