[Rspamd-Users] Something simple

[James B Huber]

I am trying to do something which I would have thought was very
simple...

Apparently I am too simple abd can't make it work, so I am reaching out
for help/education.

Running rspamd (ver. 2.5) on a Centos-7.7 machine.

Goal: be able to reject (or jack up score/points) based on content
within a message body (I have local white/blacklists working based on
sender/receiver, IP, domain, etc.)

So in /etc/rspamd/local.d/multimap.conf I added the following:
local_content_reject {
  type = "content";
  filter = "body";
  map = "$CONFDIR/maps.d/content.map";
  symbol = "REJECT_CONTENT";
  action = "reject";
  regex = true;
  description = "Reject based on message content";
}

*FYI $CONFDIR == /etc/rspamd

/etc/rspamd/maps.d/content.map contains 3 lines, the last line being
just a "return" or NEWLINE:
^Shipping Address: 2270 E. Park Ave$
This_should_be_seen_jbh

I can see in the log file (/var/log/rspamd/rspamd.log) that if I edit
the "content.map" file that it is being read:
2020-04-14 10:56:40 #4228(rspamd_proxy) <mh8u3j>; map;
rspamd_map_file_read_callback: rereading map file
/etc/rspamd/maps.d/content.map
2020-04-14 10:56:40 #4228(rspamd_proxy) <mh8u3j>; map;
rspamd_kv_list_fin: read hash of 2 elements
2020-04-14 10:56:42 #4232(controller) <mh8u3j>; map;
rspamd_map_file_read_callback: rereading map file
/etc/rspamd/maps.d/content.map
2020-04-14 10:56:42 #4232(controller) <mh8u3j>; map;
rspamd_kv_list_fin: read hash of 2 elements

However, when I send an email into my mailer (from like yahoo or gmail)
which contains a body (and it's a cut & paste) containing ONLY (for
example) "This_should_be_seen_jbh" it goes thru cleanly and never trips
the rules...
I can see the symbol " REJECT_CONTENT" fromthe web-gui (shows it should
ge a score of 8)...

What am I missing, sorry to have to ask, I am sure this is simple and I
will feel stupid once you all tell me..

Thanks,
Jim