[Rspamd-Users] multimap - content filter: how to set the found text part within X-Spamd-Result

[Markus N.]

How can I set the found text part within [] in the X-Spamd-Result: Header?

At the moment it is working but as rules get more complex the empty [] 
does not help debugging.

Am 21.09.21 um 14:49 schrieb Andreas Wass - Glas Gasperlmair:
> found a solution and did it this way:
> 
> 1. step
> 
> vi /etc/rspamd/local.d/multimap.conf
> 
> CONTENT_BLACKLISTED {
>    type = "content";
>    filter = "body"; # can be headers, full, oneline, text, rawtext
>    map = "${LOCAL_CONFDIR}/local.d/local_content.map";
>    symbols = ["CONTENT_BLACKLISTED1"];
>    regexp = true;
> }
> 
> 2. step
> vi /etc/rspamd/local.d/groups.conf
> 
> group "MyGroup" {
>    symbols =  {
>      "CONTENT_BLACKLISTED1" {
>        # score = Multiplikator und wird mit Wert in local_content.map 
> (steht hinter dem Doppelpunkt z.B. /Spende/ CONTENT_BLACKLISTED1:10) 
> multipliziert
>        score = 1.0;
>      }
>    }
> }
> 
> 3. step
> vi /etc/rspamd/local.d/local_content.map
> 
> # searchtext (case sensitiv) - Symbol - Score
> # Score wird mit Multiplikator in /etc/rspamd/local.d/groups.conf 
> multipliziert
> 
> # Score >= 15 rejecten
> /Wir haben eine Spende für Sie/ CONTENT_BLACKLISTED1:30
> 
> # ab Score >= 6 soft reject (greylist)
> /Die Spende/ CONTENT_BLACKLISTED1:7
> 
> 
> best regards, Andy
> 
> Am 21.09.2021 um 13:12 schrieb Aste:
>> Hi!
>>
>> Tuesday, September 21, 2021, 1:43:13 PM, you wrote:
>> AWGG> # local.d/multimap.conf
>> AWGG> CONTENT_BLACKLISTED {
>> AWGG>    type = "content";
>> AWGG>    filter = "body"; # can be headers, full, oneline, text, rawtext
>> AWGG>    map = "${LOCAL_CONFDIR}/local.d/local_content.map";
>> According to documentation you need to specify map type as multimap
>> map  = regexp_multi;  ${LOCAL_CONFDIR}/local.d/local_content.map;
>>
>> And you always can add global score there
>> score = 10;
>>
>> AWGG>    symbols = ["CONTENT_BLACKLISTED1", "CONTENT_BLACKLISTED2"];
>> AWGG>    regexp = true;
>> AWGG> }
>>
>> AWGG> In this example, you can use 3 symbols:
>>
>> AWGG>      CONTENT_BLACKLISTED
>> AWGG>      CONTENT_BLACKLISTED1
>> AWGG>      CONTENT_BLACKLISTED2
>>
>> AWGG> the map:
>>
>> AWGG> # Symbol + score
>> AWGG> /re1/ CONTENT_BLACKLISTED1:10
>> AWGG> # Symbol with default score
>> AWGG> /re2/ CONTENT_BLACKLISTED2
>> AWGG> # Just a default symbol: CONTENT_BLACKLISTED
>> AWGG> /re3/
>>
>> AWGG> Symbols that are not defined in the symbols attribute but used 
>> in the map are ignored and replaced by the default map symbol. If the 
>> value of a key-value pair is missing, then Rspamd just inserts the 
>> default symbol with dynamic weight equal to 1.0 (which is multiplied 
>> by metric score afterwards)
>>
>>
>> AWGG> ...matches the right symbol (CONTENT_BLACKLISTED1) in the header :
>>
>> AWGG> X-Spamd-Result: default: False [0.80 / 15.00];
>> AWGG>      ...
>> AWGG>      CONTENT_BLACKLISTED1(0.00)[];
>> AWGG>      ...
>>
>> AWGG> ...but why is score 0.00 and not 10 like it is defined in 
>> local_content.map?
>>
>>
>> AWGG> best regards, Andy
>>
>> AWGG> Am 21.09.2021 um 11:53 schrieb Andreas Wass - Glas Gasperlmair:
>>>> Hi,
>>>>
>>>> i'm trying to use rspamd as soon as possible for our company > 
>>>> mailserver, and testing content filtering with multimap as shown in
>>>>
>>>> https://rspamd.com/doc/modules/multimap.html
>>>>
>>>> *Configured the following.*..
>>>>
>>>>
>>>>     Multiple symbol maps
>>>>
>>>>  From the version 1.3.1, it is possible to define multiple symbols 
>>>> and > scores using multimap module. To do that, you should define 
>>>> all > possible symbols using|symbols|option in multimap:
>>>>
>>>> |# local.d/multimap.conf CONTENT_BLACKLISTED { type = "content"; > 
>>>> filter = "body"; # can be headers, full, oneline, text, rawtext map 
>>>> = > "${LOCAL_CONFDIR}/local.d/local_content.map"; symbols = > 
>>>> ["CONTENT_BLACKLISTED1", "CONTENT_BLACKLISTED2"]; regexp = true; } |
>>>>
>>>> In this example, you can use 3 symbols:
>>>>
>>>>   * CONTENT_BLACKLISTED
>>>>   * CONTENT_BLACKLISTED1
>>>>   * CONTENT_BLACKLISTED2
>>>>
>>>> the map:
>>>>
>>>> |# Symbol + score /re1/ CONTENT_BLACKLISTED1:10 # Symbol with 
>>>> default > score /re2/ CONTENT_BLACKLISTED2 # Just a default symbol: 
>>>> > CONTENT_BLACKLISTED /re3/ |
>>>>
>>>> Symbols that are not defined in the|symbols|attribute but used in 
>>>> the > map are ignored and replaced by the default map symbol. If the 
>>>> value > of a key-value pair is missing, then Rspamd just inserts the 
>>>> default > symbol with dynamic weight equal to|1.0|(which is 
>>>> multiplied by metric > score afterwards)
>>>>
>>>>
>>>> *...matches the right symbol (CONTENT_BLACKLISTED1) in the header :*
>>>>
>>>> X-Spamd-Result: default: False [0.80 / 15.00];
>>>>      ...
>>>>      CONTENT_BLACKLISTED1(0.00)[];
>>>>      ...
>>>>
>>>> *...but why is score 0.00 and not 10 like it is defined in > 
>>>> local_content.map?*
>>>>
>>>>
>>>> best regards, Andy
>>>>
>>
>>
>>
>