[Rspamd-Users] Multimap - Map content

[Michael Grimm]

Gerald Galster <list+rspamd at gcore.biz> wrote:

First of all, I'd like to thank you for your valuable mails regarding multimaps; learned a lot!

>> Can I add scores to each one individually?
> 
> Yes.
> 
> local.d/multimap.conf:
> 
> BODY_SPAM {
> type = "content";
> filter = "oneline";
> map = "file:///etc/rspamd/local.d/body_spam.map";
> multi = true;
> regexp = true;
> }
> 
> /etc/rspamd/local.d/body_spam.map:
> 
> /Trades/ BODY_SPAM:0.12
> /Armut\sim\sRuhestand/ BODY_SPAM:5.82

[snip]

> Try it this way:
> 
> 1) key
> 2) key symbol
> 3) key symbol:score
> 
> Currently you seem to use 1).
> 
> 1) Your map contains keys (in this case regexes) only
> 
>   /Armut\sim\sRuhestand/
> 
> 2) You could also set a symbol
> 
>   /Armut\sim\sRuhestand/ BODY_SPAM
>   /Bitcoin\sim\sRuhestand/ BITCOIN_SPAM
> 
>   You define which symbols are allowed in multimap.conf, see:
>   https://rspamd.com/doc/modules/multimap.html#multiple-symbol-maps
> 
> 3) You could set a symbol and a score
> 
>   /Armut\sim\sRuhestand/ BODY_SPAM:5.82
>   /Trades/ BODY_SPAM:0.12
> 
>   This is very useful. You can set a higher score for terms found in
>   spam only.
> 
> 1) and 2) use the score set in multimap.conf/metrics.conf (or default score).

I did try that but failed:

multimap.conf:

MM_BL_BODY {
	type = "content";
	filter = "oneline";
	multi = true;
	regexp = true;
	map = "/usr/local/etc/rspamd/local.d/MM_BL_BODY.map";
	description = "blacklist specific key words in body"
}

MM_BL_BODY.map:

	/boost\s+your\s+business/i MM_BL_BODY:7.50


I tested a sample mail with this sentence in WebUI, but MM_BL_BODY { } didn't trigger that.

After some tweaking in multimap.conf and MM_BL_BODY.map I found a solution, but I do not understand why that is needed:

I had had to add (score):

MM_BL_BODY {
>>>	score = 1;
	type = "content";
	filter = "oneline";
	multi = true;
	regexp = true;
	map = "/usr/local/etc/rspamd/local.d/MM_BL_BODY.map";
	description = "blacklist specific key words in body"
}


Any help in understanding this is highly appreciated,
Michael