Subject: Is there any way to tell which rule a message was filtered by?

From: Matt Ackeret <[email-masked]>
Date: Fri, 19 Mar 2004 11:24:34 -0800 (PST)

I used to use SetScores and a filtering rule based upon that to filter out
some spam.

I wanted to change it to direct filtering rules that were more logical.

The main rule I'm using is "not to me or my mailing lists", which is
Recip pattern     = [email-masked],[email-masked],pineinf...

and if it matches this, then the messages go to the suspected spam folder.

The ! is done after the rest, right?

i.e. it's

! ([email-masked] OR [email-masked] OR ....)

So the rule is only successful if NONE of them are a Recipient.. right?

If not, how can I end up doing this with direct filters?  (because I can't
do a ! on every address in an individual filter, because then everything
would hit one of them)
-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Steve Hubert <[email-masked]>
Date: Fri, 19 Mar 2004 17:58:28 -0800 (PST)

> So the rule is only successful if NONE of them are a Recipient.. right?

Right. Just to be clear, the "!" is not typed in as part of the pattern's 
value, "!" is a command that turns Not on or off for a particular pattern. 
So you'd end up with the line looking like

  ! Recip pattern   = abc,def

as opposed to

  Recip pattern     = !abc,def

But, provided that that is what you meant, then the answer is yes. It does 
mean:

Steve Hubert <[email-masked]>
Univ. of Washington: Computing and Communications, Seattle

---

From: Matt Ackeret <[email-masked]>
Date: Fri, 19 Mar 2004 18:01:00 -0800 (PST)

>   ! ([email-masked] OR [email-masked] OR ....)

Then that still leads me to wonder why some of my mail is incorrectly being
labelled as spam even though it clearly is directed to me and doesn't
contain words that hit other spam filters (".info", ".biz", etc.)

---

From: Steve Hubert <[email-masked]>
Date: Fri, 19 Mar 2004 18:19:51 -0800 (PST)

You could try running pine with

    pine -d verbose=5,imap=4

You would be interested in the debugging output that follows

   process_filter_patterns...

in the debug file. It should tell which filter matchs a message with a 
line like

  FILTER matching "<filter_name>": msg # "filed"              or
                                         "killed"

for each message for which the action is to move it to another folder or 
to delete it. I see that it won't print anything if the filter just sets 
the state or does nothing.

The imap=4 is in the debug so that we might be able to figure out why the 
match didn't happen. There should be imap SEARCH commands interspersed 
between the filters where pine is trying to do the matching. If you 
identify a message that should have matched and didn't, or vice versa, 
find the message and look at the raw message to see if something is 
strange about it that might cause the miss.

Alternatively, you can skip the debug stuff and just try to look at 
messages that get misfiled.

We ([email-masked]) are interested in hearing about the results 
or helping by looking at debug files if you think that would help. Thanks.

---

From: Matt Ackeret <[email-masked]>
Date: Thu, 25 Mar 2004 18:54:58 -0800 (PST)

>in the debug file. It should tell which filter matchs a message with a

Thanks a lot.  It ended up being user-error.

After nuking most of my old filters and starting over, I tried a "spam words"
filter (and mentioning this may hit some others' filters.. ohwell)

My filter was:
viagra,cialis,viag,cial,microsoft security,memolink.com

and duhh, I just realizec that "cial" is in a lot of words!  Heh.

Darn, if I could do "^cial" or something for start-of-word, this would
still be a reasonable filter.. (Since of course viagra and cialis don't
appear as full words too often anymore.)

and btw, this is *after* spamassassin runs.. a lot of stuff still gets
in my inbox.  The stuff that spamassassin gets goes directly to /dev/null.

I used to be paranoid about spamassassin catching good mail, but I have only
ever seen my own filters (like the above!) goof up.

---

From: Nancy McGough <[email-masked]>
Date: Fri, 26 Mar 2004 00:02:58 -0800 (PST)

> in my inbox.  The stuff that spamassassin gets goes directly to /dev/null.

I recommend that before you try to detect spam, you first detect
non-spam. One way to do that within Pine is to filter all
messages from addresses in your address book by using this type
of condition:

 From or ReplyTo is in address book? =
            Set    Choose One
            ---  --------------------
            ( )  Don't care, always matches
            (*)  Yes, in any address book
            ( )  No, not in any address book
            ( )  Yes, in specific address books
            ( )  No, not in any of specific address books
                 Abook List = <No Value Set>

and then put everyone you correspond with in your address book!
I discuss this type of "reverse spam filtering" here:

 <http://www.ii.com/internet/messaging/spam/>

If you use procmail, you could try LOAF, which is a a GPL'd
distributed social network filter that automatically "greenlists"
your pine address book and the address book of your
correspondents (and the address book of your correspondents'
correspondents, ad infinitum if you like!). Details are here:

 <http://loaf.cantbedone.org/>

Hope this is helful,
Nancy

-- 
Nancy McGough
Infinite Ink ~ <http://www.ii.com>
Deflexion & Reflexion ~ <http://deflexion.com>

---

From: Matt Ackeret <[email-masked]>
Date: Fri, 26 Mar 2004 12:22:33 -0800 (PST)

>messages from addresses in your address book by using this type

I'm largely a filter-hater.  For the most part, I only filter spam (and
I philosophically disagree with that, but it's gotten too voluminous to
complain about all of it), and on my work account one of the mailing lists
I'm on to another folder.

Basically, could this detect non-spam tactic work if I by default want
stuff to REMAIN in my INBOX?  I don't think it will, because I think it would
just keep hitting the rest of the filtering rules and thus possibly be
triggered by one of them.

Actually, one of my recent tactics (which started this or one of the other
threads I sent recently) was sort of trying to accomplish the same goal as
your addressbook one is -- I was trying to assume messages that weren't to
me or my mailing lists were spam..  But that didn't seem to work well.

If I can add all of my mailing lists to my address book, add another rule
or two (looking for a Newsgroups: header for example because about the
only stuff I get on my personal acct besides some mailing lists is replies
to Usenet postings), then anything ELSE is assumed to be spam..  then
that would probably help a lot.

I'll still manually skim my suspected_spam folder, but it'd be a start.

---

From: Steve Hubert <[email-masked]>
Date: Mon, 29 Mar 2004 08:37:50 -0800 (PST)

> triggered by one of them.

You can have a filter which matches and does nothing. Set it to "Just Set 
Message Status" and then have it set nothing. If a message matches that 
filter, nothing will be done to it and it won't be eligible to be matched 
by filter rules which follow that rule. So it will just be left in the 
INBOX.

Steve