[SA-exim] How to save only "suspect" notspam?

[Marc MERLIN]

On Tue, Feb 24, 2004 at 11:32:44AM -0800, Balam Willemsen wrote:
> Hi all,
>  
> I'm just migrating over to sa-exim from calling spamc from the system filter in exim3 and it works great!
>  
> One thing I was doing before though that I can't seem to figure out how to do now is to save mail that was scored as ham, but scored over some threshold. This is really useful for learning false negatives since it saves the main in the pristine form in which it was received unlike what we get back once it has been deivered to our Exchange server.
>  
> I was doing this with:
>  
> if ("$h_X-Spam-Status:" contains "No, ") and
>    ("$h_X-Spam-Level:" contains "***") 
> then
>    unseen save /var/archives/spam/probable/$message_id
> endif
> 
>  
> I tried 
>  
> SAnotspamSavCond: ${if and { {match {$h_X-Spam-Status:}{"No, "}} {match {$h_X-Spam-Level:}{"***"}} } {1}{0}}
>  
> But that doesn't seem to work. I tried escaping the *s, but that didn't help.
>  
> Is there any way to do this with sa-exim without resorting to a system filter?

Nice idea, but it may not work because of exim not yet seeing the new
X-Spam headers when sa-exim just added them.
Did you check whether those even get defined by that time?

Otherwise, off hand, your condition looks ok, even though I could be
missing something by just looking at it.

Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/   |   Finger marc_f at merlins.org for PGP key