sieve filter move wrong email to Junk folder

[Larry Rosenman]

This is what I use with Exim, spam.sieve is included in from a master.sieve:

thebighonker.lerctr.org /home/ler $ more sieve/spam.sieve
require ["fileinto","imap4flags"];
if header :contains ["X-LERCTR-Spam-Flag","X-TNTSCAN-Spam-Flag"]  "YES"
{
   redirect "spamtrap at spambouncer.org";
   fileinto :flags "\\Seen Junk" "SPAM";
   stop;
}

thebighonker.lerctr.org /home/ler $ grep -B10 -A10 -- -Spam-Flag /usr/local/etc/exim/configure
        spam = smmsp:true
  warn  message = X-LERCTR-Spam-Score: $spam_score ($spam_bar)
        ! authenticated = *
        spam = smmsp:true
  warn  message = X-Spam-Report: $spam_report
        ! authenticated = *
        spam = smmsp:true
  warn  message = X-LERCTR-Spam-Report: $spam_report
        ! authenticated = *
        spam = smmsp:true
  # Add X-Spam-Flag if spam is over system-wide threshold
  warn message = X-Spam-Flag: YES
        ! authenticated = *
        spam = smmsp:true
        condition = ${if >={$spam_score_int}{50}{1}{0}}
  warn message = X-LERCTR-Spam-Flag: YES
        ! authenticated = *
        spam = smmsp:true
        condition = ${if >={$spam_score_int}{50}{1}{0}}

  #warn  message = DomainKey-Status: $dkim_status
#	!condition = ${if eq{$dkim_status}{}{1}{0}}
  # Reject spam messages with score over 7, using an extra condition.
  deny  message = This message scored $spam_score points. Congratulations!
        ! authenticated = *
        spam = smmsp:true
thebighonker.lerctr.org /home/ler $

On 12/14/17, 1:04 PM, "dovecot on behalf of Gao" <dovecot-bounces at dovecot.org on behalf of gao at pztop.com> wrote:

    Well I changed the line to
               if header :contains "X-Spam-Status: YES" {
    
    Then I got:
    # sievec spam_to_junk.sieve
    spam_to_junk: line 3: error: the header test requires 2 positional 
    argument(s), but 1 is/are specified.
    spam_to_junk: error: validation failed.
    sievec(root): Fatal: failed to compile sieve script 'spam_to_junk.sieve'
    
    
    Should it be:
               if header :contains "X-Spam-Status" "X-Spam-Status: YES" {
    
    ???
    I need to learn some sieve grammar.
    
    Gao
    
    On 2017-12-14 10:02 AM, Richard wrote:
    >
    >> Date: Thursday, December 14, 2017 09:47:44 -0800
    >> From: Gao <gao at pztop.com>
    >>
    >> I use a sieve filter to move spam email to user's Junk folder:
    >> # cat spam_to_junk.sieve
    >> require "fileinto";
    >>     if exists "X-Spam-Status" {
    >>             if header :contains "X-Spam-Status" "YES" {
    >>             fileinto "Junk";
    >>             stop;
    >>             } else {
    >>         }
    >>     }
    >>     if header :contains "subject" ["SPAM?"] {
    >>       fileinto "Junk";
    >>       stop;
    >>     }
    >>
    >> Most time this filter works fine but occasionally it move non-spam
    >> in to Junk folder. Here is an example, this email is from dovecot
    >> mailling list and it end up in my Junk folder. Mailllog and header
    >> here. Would someone help me to figure out what went wrong here?
    >>
    >> Thanks.
    >>
    >> Gao
    >>
    >    > X-Spam-Status: No, score=-2.9 required=5.0
    >           tests=ALL_TRUSTED,BAYES_00
    >
    >
    > Because of the way you are bounding it, I suspect that the "YES" in
    > BAYES_00, at the end of that line, is triggering the mis-filing.
    >
    > Why not make:
    >
    >     contains "X-Spam-Status" "YES"
    >
    > a single string:
    >
    >     contains "X-Spam-Status: YES"
    >
    > that would be more precise and avoid this issue.
    >
    >