Mailing List Archive

Hi Rajesh, I believe that the ShortCircuit feature is what you want
which along with the priority level helps controls the order of rules. 

https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Shortcircuit.html

Beyond that, the order they run is complicated depending on the type of
rules and I'm not sure there is a good, documented answer for it.  Will
have to defer to another person on that but that ShortCircuit might be
enough to serve your purpose.

Regards,

KAM

On 9/5/2020 8:24 AM, Rajesh M wrote:
> dear friends,
>
> had a few questions
>
> 1) what is the sequence based on which the rules are processed ?
> is there any documentation on this ?
> how is the rule number example 20_dnsbl_tests.cf or 25_uribl.cf related to the sequence of rule processing ?
>
> 2) is there a way by which if a specific rule is triggered i can stop all further processing.
> basically we plan to implement certain rules related to specific body or header content which we are sure is spam and do not wish to process any further and these will be placed in the local.cf file at the beginning
>
> thanks and regards
> rajesh
>
>
--
Kevin A. McGrail
KMcGrail@Apache.org

Member, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
https://www.linkedin.com/in/kmcgrail - 703.798.0171

On Sat, 5 Sep 2020, Rajesh M wrote:

> how is the rule number example 20_dnsbl_tests.cf or 25_uribl.cf related to the sequence of rule processing ?

It doesn't affect processing, but it does affect configuration.

The rules files are parsed in filename-sort order, so if there are
multiple definitions for (e.g.) the score for URIBL_BLACK in 50_scores.cf
and zzz_local_scores.cf, then the definition in zzz_local_scores.cf is
read last and is the score that is actually used.

This sort of thing is what is meant when "local score override" or "local
rule override" is mentioned on the list.

> 2) is there a way by which if a specific rule is triggered i can stop all further processing.
> basically we plan to implement certain rules related to specific body or header content which we are sure is spam and do not wish to process any further and these will be placed in the local.cf file at the beginning

If you are trying to implement optimized poison-pill content scanning,
then perhaps SA is *not* the best place to do that. SA is a very
complicated and rich message analysis and scoring engine and, thus, has a
good deal of per-message overhead. Shortcircuit is a way to try to avoid
that overhead for certain cases, but it is not always the *best* way.

It's very likely that your MTA offers a sufficiently-powerful naïve
pattern-matching capability to do your desired poison-pill scanning much
more efficiently than calling SA.

If you'll tell us what MTA you're using, perhaps the list can provide
suggestions for that approach.



--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
'Garbage In, Garbage Out' should not be taken to imply
any sort of conservation law
limiting the amount of garbage produced. -- Randall Munroe
-----------------------------------------------------------------------
12 days until the 233rd anniversary of the signing of the U.S. Constitution

On Sat, 5 Sep 2020, Rajesh M wrote:

> dear friends,
>
> had a few questions
>
> 1) what is the sequence based on which the rules are processed ?
> is there any documentation on this ?
> how is the rule number example 20_dnsbl_tests.cf or 25_uribl.cf related to the sequence of rule processing ?

Are you asking about rule sequencing or configuration file sequencing?
"20_dnsbl_tests.cf" is a configuration file which contains zero or more rules.

During startup spamassassin reads all configuration files that are found in a
list of specific directories (which are distro dependent). The directories are
searched in list order for configuration files (name.cf), the files are read in
lexical order.

So if you have a rule (EG: "MY_RULE_2") in file 20_my_rules.cf and another
instance of "MY_RULE_2" in 99_my_rules.cf (in the same directory) the "99" file
will be read after the "20" file and the latter definition of "MY_RULE_2" will
over-ride (replace) the one from "20".

Also the system provided rules directories are processed before the user
supplied directories (intentionally) so a user can over-ride a system rule if
they don't like how that particular rule works.
See:
https://cwiki.apache.org/confluence/display/SPAMASSASSIN/WhereDoLocalSettingsGo

Once all the rules are read and parsed spamassassin has an internal order to how
specific rules get run.

--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center, 103 S Capitol St.
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{