Thanks for your post, Tom.
The solution was so obvious (once it was pointed out to me).
What happened was, after running spamassassin for a while, the BAYES_00
filter kicked in; that's BA Y E S _00. And guess what I'm checking for
in my user filter? Y E S. Doh!
I changed the filter to look for 'contains "X-Spam-Status: Yes"' and
that seems to have done it.
>
> What does your ACL entry look like? Do you invoke SA via exiscan at all?
> What headers do you add?
>
The ACL obviously had nothing to do with it and no, I don't invoke SA
via exiscan. I use a 'spamcheck' transport that executes '/usr/bin/spamc
-s 500000'. The headers are added by spamd (I assume).
>> # Exim filter
>> if
>> $h_X-Spam-Status: contains "Yes"
>> or
>> "${if def:h_X-Spam-Flag {def}{undef}}" is "def"
>> then
>> save $home/spam
>> finish
>> endif
Ya, that's it. My 'yes' blunder is now glaringly obvious (I'm so ashamed).
>
> So it is spam if the X-Spam-Flag header is defined, even if it is empty?
>
That's right. It seems that spamd only adds the X-Spam-Flag when the
e-mail is flagged as spam. I guess that the 'or' check is redundant but
I got this recipe from:
http://dman.ddts.net/~dman/config_docs/exim4_spamassassin.html
and it's served me well until now.
Again, thanks to all who responded and set me straight.
--
Regards
Frank S. Bernhardt
b.c.s.i.
14 Halton Court
Markham, ON. Canada
L3P 6R3
905-471-1691 Voice
905-471-3016 FAX
frank@???
Registered Linux-User #312398 with the Linux Counter,
http://counter.li.org.
