On May 15, 2006, at 7:10 AM, Matt Kettler wrote:
Jean-Paul Natola wrote:
Hi all
These homeowner spasm are still getting through ( a lot less though
since
adding the KAM_GEO_STRING2 rule.
I do NOT know how to write rules, but I have an idea that perhaps can
reduce
the homeowner / credit spams.
It would be something along the lines of;
If message contains the % symbol score it .2
If message contains the % 2 times score it .5
If Message contains the % 3 or more times score it 1.5
I think this combined with the KAM_GEO_STRING2 rule could/would help
eliminate these messages.
BUT I do not know hot to create such rules
Counting occurrences of something across the entire body of the message
is not something SA is good at with just rules. You'd need a plugin to
do it.
You don't need to actually count them. The following 3 rules will do
what he wants:
a) a regexp that looks for 3 occurrences of % gives it a score of +1
(something akin to /%.*%.*%/)
b) a regexp that looks for 2 occurrences of % gives it a score of +.3
(/%.*%/)
c) a regexp that looks for 1 occurrence of % gives it a score of +.2
(/%/)
I don't recall if % needs to be escaped, though... but those are the 3
regexps you'd need. Instead of counting, you're just stacking up the
rule values. Since it's just "1, 2, 3+", it's not unwieldy to do it
this way... if it was "some arbitrary number" or a non-trivial range of
numbers ... that'd start to become difficult to manage and encode.
(and, I don't recall off the top of my head what the full rule
statements would be: I just woke up, so I'll leave that to someone else
to write out)
