[SA-exim] How to save only "suspect" notspam?

[Balam Willemsen]

Hi all,
 
I'm just migrating over to sa-exim from calling spamc from the system filter in exim3 and it works great!
 
One thing I was doing before though that I can't seem to figure out how to do now is to save mail that was scored as ham, but scored over some threshold. This is really useful for learning false negatives since it saves the main in the pristine form in which it was received unlike what we get back once it has been deivered to our Exchange server.
 
I was doing this with:
 
if ("$h_X-Spam-Status:" contains "No, ") and
   ("$h_X-Spam-Level:" contains "***") 
then
   unseen save /var/archives/spam/probable/$message_id
endif

 
I tried 
 
SAnotspamSavCond: ${if and { {match {$h_X-Spam-Status:}{"No, "}} {match {$h_X-Spam-Level:}{"***"}} } {1}{0}}
 
But that doesn't seem to work. I tried escaping the *s, but that didn't help.
 
Is there any way to do this with sa-exim without resorting to a system filter?
 
Thanks!
 
Balam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.merlins.org/archives/sa-exim/attachments/20040224/92d6f0b5/attachment.html