On 11/27/2011 8:26 AM, Martin Gregorie wrote:
Change the meta to this:
meta PORN_RULES (__PORN_RULE01 || __PORN_RULE02)
A quick glance at the SA rules for name prefixes would have told you
that rules with names that start with a double underscore have a zero
score, so your meta will never work: these rules are designed to be
combined by using logical operators.
Martin,
That's not true from my knowledge or experience. The meta mathematical
operators are binary. ("The value of the sub rule in an arithmetic meta
rule is the true/false (1/0) value for whether or not the rule hit. "
from http://wiki.apache.org/spamassassin/WritingRules)
i.e.
True = 1
False = 0
However, your test would have worked as it simplifies the math with an
OR condition.
Thought, his meta of __PORN_RULE01 + __PORN_RULE02 >=1 will work.
Though I wish sometimes you could do what you've described. I've done
some crazy work to try and give meta rules extra weighting. But I think
doing so would give the mass check algorithm more permutations than it
could ever handle.
For example, here's how I weighted two options to have the weight of
just one in detecting a refinance spam:
meta KAM_REFI (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3
+ __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 +
__KAM_REFI8 >= 4)
Regards,
KAM
