Can the "SpamAssassin Rule Hits" report include the score of a rule?

Request and discuss new features you would like to have.
Post Reply
ovizii
Posts: 463
Joined: 11 May 2016 08:08

Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by ovizii »

That would be immensely useful as I often check those stats to see what could be combined or pushed and the information i.e. 100% SPAM doesn't really help without knowing what the score was. So I often find myself checking stats in that report then using ssh to check for the corresponding score :-(
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by shawniverson »

/etc/MailScanner/MailScanner.conf

Code: Select all

# Do you want the full spam report, or just a simple "spam / not spam" report?
Detailed Spam Report = yes

# Do you want to include the numerical scores in the detailed SpamAssassin
# report, or just list the names of the scores
Include Scores In SpamAssassin Report = yes

# Do you want to always include the Spam Report in the SpamCheck
# header, even if the message wasn't spam?
# This can also be the filename of a ruleset.
Always Include SpamAssassin Report = no
ovizii
Posts: 463
Joined: 11 May 2016 08:08

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by ovizii »

thanks, but we're not talking about the same thing. I meant this: EFA => Reports => SpamAssassin Rule Hits
efa---.png
efa---.png (64.29 KiB) Viewed 7510 times
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by shawniverson »

ic.

Looks like a MailWatch thing.... :think: should be displaying scores but is not....I'll do so testing with latest MailWatch code...
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by pdwalker »

Hi Shawn,

I had a look. mailscanner/rep_sa_rule_hits.php throws the scores away (see lines 85-87 in particular):

Code: Select all

 76     // Split the array, and get rid of the score and required values
 77     if (isset($sa_rules[0])) {
 78         $sa_rules = explode(", ", $sa_rules[0]);
 79     } else {
 80         $sa_rules = array();
 81     }
 82     $junk = array_shift($sa_rules); // score=
 83     $junk = array_shift($sa_rules); // required
 84     foreach ($sa_rules as $rule) {
 85         // Check if SA scoring is present
 86         if (preg_match('/^(.+) (.+)$/', $rule, $regs)) {
 87             $rule = $regs[1];
 88         }
It shouldn't be too hard to submit this as a feature request to the mailwatch project. It shouldn't be too hard a change to implement. We just have to keep the information and not throw it away
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by pdwalker »

make a backup copy of your rep_sa_rule_hits.php file and apply the following changes:

Code: Select all

[user@efa mailscanner]# diff -c rep_sa_rule_hits.php rep_sa_rule_hits-new.php
*** rep_sa_rule_hits.php       	2016-08-19 19:53:59.204962437 +0800
--- rep_sa_rule_hits-new.php   	2016-08-19 20:15:39.413789144 +0800
***************
*** 85,90 ****
--- 85,91 ----
          // Check if SA scoring is present
          if (preg_match('/^(.+) (.+)$/', $rule, $regs)) {
              $rule = $regs[1];
+             $score = $regs[2];
          }
          if (isset($sa_array[$rule]['total'])) {
              $sa_array[$rule]['total']++;
***************
*** 92,97 ****
--- 93,102 ----
              $sa_array[$rule]['total'] = 1;
          }

+         if (!isset($sa_array[$rule]['score'])) {
+             $sa_array[$rule]['score'] = $score;
+         }
+
          // Initialise the other dimensions of the array
          if (!isset($sa_array[$rule]['spam'])) {
              $sa_array[$rule]['spam'] = 0;
***************
*** 120,125 ****
--- 125,131 ----
  <TR BGCOLOR=\"#F7CE4A\">
   <TH>Rule</TH>
   <TH>Description</TH>
+  <TH>Score</TH>
   <TH>Total</TH>
   <TH>Ham</TH>
   <TH>%</TH>
***************
*** 132,137 ****
--- 138,144 ----
  <TR BGCOLOR=\"#EBEBEB\">
   <TD>$key</TD>
   <TD>" . htmlentities(return_sa_rule_desc(strtoupper($key))) . "</TD>
+  <TD ALIGN='RIGHT'>" . sprintf("%0.2f",$val['score']) . "</TD>
   <TD ALIGN=\"RIGHT\">" . number_format($val['total']) . "</TD>
   <TD ALIGN=\"RIGHT\">" . number_format($val['not-spam']) . "</TD>
   <TD ALIGN=\"RIGHT\">" . round(($val['not-spam'] / $val['total']) * 100, 1) . "</TD>
Note: This is a diff between the rep_sa_rule_hits.php and my copy rep_sa_rule_hits-new.php.

All you need to do is find the lines with the +'s and add them to your version.

That's 7 lines added to give a report looking like:
Screen Shot 2016-08-19 at 20.18.png
Screen Shot 2016-08-19 at 20.18.png (110.32 KiB) Viewed 7425 times
I'll submit this as a feature request to the mailwatch project.

Note: if you change your spamassassin scoring, this report will only show you the first score it picks up from the database, rather than the current score. It is likely the score it picks up is the older one.

e.g. if I changed my BAYES_00 score from -1.9 to +37.0, the report would still show -1.9 even though new messages are scored with +37, until all the messages with that SA_RULE and score are aged out of the database.
ovizii
Posts: 463
Joined: 11 May 2016 08:08

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by ovizii »

thanks, worked perfectly!
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by shawniverson »

User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Can the "SpamAssassin Rule Hits" report include the score of a rule?

Post by pdwalker »

Thanks. I've still not mastered the use of github.

One thing, I've looked at your changed and it appears you've left out the two lines required to display the results in the html table.

Look for two single line additions at the bottom of the diff.
Post Reply