Mailing List Archive

Denny,

If you read the fine manual for the spamassassin configuration file, in section
for 'score SYMBOLIC_TEST_NAME n.nn [ n.nn n.nn n.nn ]'

You'll see:

If only one valid score is listed, then that score is always used for a test.

If four valid scores are listed, then the score that is used depends on how
SpamAssassin is being used. The first score is used when both Bayes and network
tests are disabled (score set 0). The second score is used when Bayes is
disabled, but network tests are enabled (score set 1). The third score is used
when Bayes is enabled and network tests are disabled (score set 2). The fourth
score is used when Bayes is enabled and network tests are enabled (score set 3).

So when there are four score values it will use the one relevant to your SA's
operating condition.

EG: if the rule is senstive to the presence of network type tests, such as
DNSRBLs, the score can be adjusted accordingly.


On Wed, 30 Aug 2023, Denny Jones via users wrote:

> Hello,
>
> I have looked high and low and can't find an explanation for multi-level scoring:
>
> score SCC_CANSPAM_2    3.799    0.001    3.799    0.00
>
> What does this mean?
>
> In my simplistic way of doing things I would write this as:
>
> score SCC_CANSPAM_2     3.799
>
> Thanks for helping clear the mud in my mind!
>
> Denny
>
>
>
>

--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center, 103 S Capitol St.
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{

On 2023-08-30 at 15:14:15 UTC-0400 (Wed, 30 Aug 2023 19:14:15 +0000
(UTC))
Denny Jones via users <lhwebtek@aol.com>
is rumored to have said:

> Hello,
> I have looked high and low and can't find an explanation for
> multi-level scoring:
> score SCC_CANSPAM_2    3.799    0.001    3.799    0.00
> What does this mean?
> In my simplistic way of doing things I would write this as:
> score SCC_CANSPAM_2     3.799

Try running this:

perldoc Mail::SpamAssassin::Conf


That provides you with a man-like interface for the configuration of
SpamAssassin, extracted from the Mail::SpamAssassin::Conf perl module.
Not very far into that document you will find:

If four valid scores are listed, then the score that is used
depends
on how SpamAssassin is being used. The first score is used when
both
Bayes and network tests are disabled (score set 0). The second
score
is used when Bayes is disabled, but network tests are enabled
(score
set 1). The third score is used when Bayes is enabled and
network
tests are disabled (score set 2). The fourth score is used when
Bayes is enabled and network tests are enabled (score set 3).

Very often, you will find the the automated rescoring system will emit
what looks like a perverse set of scores with the 2 network-enabled
scores at or near zero. That is an artifact of how rescoring is done
combined with the fact that network tests are often a distillation of
other people's recent spam detections. Essentially a very 'small'
rule is duplicative of the detection being effectively done by a network
source.





--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire

Thank you for the explanation. Makes sense now.



On Wednesday, August 30, 2023 at 02:55:50 PM CDT, Bill Cole <sausers-20150205@billmail.scconsult.com> wrote:

On 2023-08-30 at 15:14:15 UTC-0400 (Wed, 30 Aug 2023 19:14:15 +0000
(UTC))
Denny Jones via users <lhwebtek@aol.com>
is rumored to have said:

> Hello,
> I have looked high and low and can't find an explanation for
> multi-level scoring:
> score SCC_CANSPAM_2    3.799    0.001    3.799    0.00
> What does this mean?
> In my simplistic way of doing things I would write this as:
> score SCC_CANSPAM_2     3.799

Try running this:

perldoc Mail::SpamAssassin::Conf


That provides you with a man-like interface for the configuration of
SpamAssassin, extracted from the Mail::SpamAssassin::Conf perl module.
Not very far into that document you will find:

        If four valid scores are listed, then the score that is used
depends
        on how SpamAssassin is being used. The first score is used when
both
        Bayes and network tests are disabled (score set 0). The second
score
        is used when Bayes is disabled, but network tests are enabled
(score
        set 1). The third score is used when Bayes is enabled and
network
        tests are disabled (score set 2). The fourth score is used when
        Bayes is enabled and network tests are enabled (score set 3).

Very often, you will find the the automated rescoring system will emit
what looks like a perverse set of scores with the 2 network-enabled
scores at or near zero. That is an artifact of how rescoring is done
combined with the fact that network tests are often a distillation of
other people's recent spam detections.      Essentially a very 'small'
rule is duplicative of the detection being effectively done by a network
source.





--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire