Page 1 of 1

Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 06 Jul 2016 11:08
by ovizii
That would be immensely useful as I often check those stats to see what could be combined or pushed and the information i.e. 100% SPAM doesn't really help without knowing what the score was. So I often find myself checking stats in that report then using ssh to check for the corresponding score :-(

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 06 Jul 2016 22:18
by shawniverson
/etc/MailScanner/MailScanner.conf

Code: Select all

# Do you want the full spam report, or just a simple "spam / not spam" report?
Detailed Spam Report = yes

# Do you want to include the numerical scores in the detailed SpamAssassin
# report, or just list the names of the scores
Include Scores In SpamAssassin Report = yes

# Do you want to always include the Spam Report in the SpamCheck
# header, even if the message wasn't spam?
# This can also be the filename of a ruleset.
Always Include SpamAssassin Report = no

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 07 Jul 2016 06:27
by ovizii
thanks, but we're not talking about the same thing. I meant this: EFA => Reports => SpamAssassin Rule Hits
efa---.png
efa---.png (64.29 KiB) Viewed 7547 times

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 15 Jul 2016 17:13
by shawniverson
ic.

Looks like a MailWatch thing.... :think: should be displaying scores but is not....I'll do so testing with latest MailWatch code...

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 19 Aug 2016 11:21
by pdwalker
Hi Shawn,

I had a look. mailscanner/rep_sa_rule_hits.php throws the scores away (see lines 85-87 in particular):

Code: Select all

 76     // Split the array, and get rid of the score and required values
 77     if (isset($sa_rules[0])) {
 78         $sa_rules = explode(", ", $sa_rules[0]);
 79     } else {
 80         $sa_rules = array();
 81     }
 82     $junk = array_shift($sa_rules); // score=
 83     $junk = array_shift($sa_rules); // required
 84     foreach ($sa_rules as $rule) {
 85         // Check if SA scoring is present
 86         if (preg_match('/^(.+) (.+)$/', $rule, $regs)) {
 87             $rule = $regs[1];
 88         }
It shouldn't be too hard to submit this as a feature request to the mailwatch project. It shouldn't be too hard a change to implement. We just have to keep the information and not throw it away

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 19 Aug 2016 12:26
by pdwalker
make a backup copy of your rep_sa_rule_hits.php file and apply the following changes:

Code: Select all

[user@efa mailscanner]# diff -c rep_sa_rule_hits.php rep_sa_rule_hits-new.php
*** rep_sa_rule_hits.php       	2016-08-19 19:53:59.204962437 +0800
--- rep_sa_rule_hits-new.php   	2016-08-19 20:15:39.413789144 +0800
***************
*** 85,90 ****
--- 85,91 ----
          // Check if SA scoring is present
          if (preg_match('/^(.+) (.+)$/', $rule, $regs)) {
              $rule = $regs[1];
+             $score = $regs[2];
          }
          if (isset($sa_array[$rule]['total'])) {
              $sa_array[$rule]['total']++;
***************
*** 92,97 ****
--- 93,102 ----
              $sa_array[$rule]['total'] = 1;
          }

+         if (!isset($sa_array[$rule]['score'])) {
+             $sa_array[$rule]['score'] = $score;
+         }
+
          // Initialise the other dimensions of the array
          if (!isset($sa_array[$rule]['spam'])) {
              $sa_array[$rule]['spam'] = 0;
***************
*** 120,125 ****
--- 125,131 ----
  <TR BGCOLOR=\"#F7CE4A\">
   <TH>Rule</TH>
   <TH>Description</TH>
+  <TH>Score</TH>
   <TH>Total</TH>
   <TH>Ham</TH>
   <TH>%</TH>
***************
*** 132,137 ****
--- 138,144 ----
  <TR BGCOLOR=\"#EBEBEB\">
   <TD>$key</TD>
   <TD>" . htmlentities(return_sa_rule_desc(strtoupper($key))) . "</TD>
+  <TD ALIGN='RIGHT'>" . sprintf("%0.2f",$val['score']) . "</TD>
   <TD ALIGN=\"RIGHT\">" . number_format($val['total']) . "</TD>
   <TD ALIGN=\"RIGHT\">" . number_format($val['not-spam']) . "</TD>
   <TD ALIGN=\"RIGHT\">" . round(($val['not-spam'] / $val['total']) * 100, 1) . "</TD>
Note: This is a diff between the rep_sa_rule_hits.php and my copy rep_sa_rule_hits-new.php.

All you need to do is find the lines with the +'s and add them to your version.

That's 7 lines added to give a report looking like:
Screen Shot 2016-08-19 at 20.18.png
Screen Shot 2016-08-19 at 20.18.png (110.32 KiB) Viewed 7462 times
I'll submit this as a feature request to the mailwatch project.

Note: if you change your spamassassin scoring, this report will only show you the first score it picks up from the database, rather than the current score. It is likely the score it picks up is the older one.

e.g. if I changed my BAYES_00 score from -1.9 to +37.0, the report would still show -1.9 even though new messages are scored with +37, until all the messages with that SA_RULE and score are aged out of the database.

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 19 Aug 2016 20:15
by ovizii
thanks, worked perfectly!

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 21 Aug 2016 16:10
by shawniverson

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Posted: 22 Aug 2016 05:24
by pdwalker
Thanks. I've still not mastered the use of github.

One thing, I've looked at your changed and it appears you've left out the two lines required to display the results in the html table.

Look for two single line additions at the bottom of the diff.