>>> Anthony Baxter wrote
> I'm currently mangling it by feeding all parts (text, html, whatever
> else :) into the filters, as well as both a selected number of headers
> (to, from, content-type, x-mailer), and also a list of
> (header,count_of_header). This is showing up some nice stuff - e.g. the
> X-uidl that stoopid spammers blindly copy into their messages.
The other thing on my todo list (probably tonight's tram ride home) is
to add all headers from non-text parts of multipart messages. If nothing
else, it'll pick up most virus email real quick.
--
Anthony Baxter     <anthony@interlink.com.au>
It's never too late to have a happy childhood.

from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id B519D440F8
	for <jm@localhost>; Fri,  2 Aug 2002 07:10:19 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Fri, 02 Aug 2002 12:10:19 +0100 (IST)
from lugh.tuatha.org (root@lugh.tuatha.org [194.125.145.45]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g72B8u219126 for
    <jm-ilug@jmason.org>; Fri, 2 Aug 2002 12:08:56 +0100
from lugh (root@localhost [127.0.0.1]) by lugh.tuatha.org
    (8.9.3/8.9.3) with ESMTP id MAA01523; Fri, 2 Aug 2002 12:07:02 +0100
from claymore.diva.ie (diva.ie [195.218.115.17] (may be forged))
    by lugh.tuatha.org (8.9.3/8.9.3) with ESMTP id MAA01489 for
    <ilug@linux.ie>; Fri, 2 Aug 2002 12:06:54 +0100
from cunniffe.net (ts01-008.dublin.indigo.ie [194.125.134.8]) by
    claymore.diva.ie (8.9.3/8.9.3) with ESMTP id MAA25581 for <ilug@linux.ie>;
    Fri, 2 Aug 2002 12:06:36 +0100
From ilug-admin@linux.ie  Fri Aug  2 12:10:27 2002

Logs user, name of job run, and pid it ran as.

from localhost (jalapeno [127.0.0.1])
	by spamassassin.taint.org (Postfix) with ESMTP id 3DBE916F17
	for <zzzz@localhost>; Tue,  8 Oct 2002 12:27:20 +0100 (IST)
from n18.grp.scd.yahoo.com (n18.grp.scd.yahoo.com
    [66.218.66.73]) by dogma.slashnull.org (8.11.6/8.11.6) with SMTP id
    g98BEuK12758 for <zzzz@spamassassin.taint.org>; Tue, 8 Oct 2002 12:14:56 +0100
From sentto-2242572-56011-1034075737-zzzz=spamassassin.taint.org@returns.groups.yahoo.com  Tue Oct  8 12:27:25 2002