> #custom rules
> body CSTM_INFINEX_VEN /infinex/
> describe CSTM_INFINEX_VEN Message mentions Infinex Ventures
> score CSTM_INFINEX_VEN 2.0
s/b ok
> body CSTM_FONT_SIZE_EQLS_2 /<td><font size\=2>/
> describe CSTM_FONT_SIZE_EQLS_2 Message contains html for small fonts
> score CSTM_FONT_SIZE_EQLS_2 .1
won't work - needs to be rawbody or full rule.
Besides, there are both standard and SARE rules already for tiny fonts.
This rule isn't particularly good, since it is testing for a 'medium' font,
which is pretty standard thing to have.
> header CSTM_SBJCT_MARKEDSPAM Subject =~ /\bSPAM:\b/i
> describe CSTM_SBJCT_MARKEDSPAM Message has the word SPAM in subject
> score CSTM_SBJCT_MARKEDSPAM 3.0
s/b ok
> body CSTM_ORGASM /orgasm/
> describe CSTM_ORGASM Message contains the word orgasm
> score CSTM_ORGASM 2.0
prolly should have \b on each size to be safe
> When I grep my rejectlog for mentions of CSTM, nothing comes up. But I'm
> still getting spam with these attributes. Thanks for your help.
1. Did you lint your rules?
2. Did you restart SA?
3. Does the rules file have the right permissions for SA to read it?
4. Did you do a 'spamassassin -D --lint' and look at what it says are the
rules directories?
5. Try manually putting a complete spam with headers in a text file and
then manually do
spamassassin -t <myspam.txt
And see what it says for rules hit.
Loren
