Hi - I tried searching for how to do this, and found instructions like below (starting at Dave's Answer).

I've followed those instructions, and Exim is flagging the mail as spam, but its still coming through to my inbox. (i'm getting about 20 a day suddenly).

I've set the keywords to mark the score as 100, and have SpamAssassin™ reject spam score threshold set to 100. I have SpamAssassin™: bounce spam score threshold set to 100 as well.

But - when i send an email with one of the keywords I used, its still coming through. It gets marked as SPAM

My lines I added to local.cf

rawbody DIPLOMA /845-709-8044/i
score DIPLOMA 100

rawbody CIALIS /cialis/i
score CIALIS 100

rawbody DIPLOMA2 /8 4 5 - 7 0 9 - 8 0 4 4/i
score DIPLOMA2 100

rawbody PHARMACY /pharmacy/i
score PHARMACY 100


Is there something I'm missing? I restarted the exim mail server and I didn't get any errors. How can I tell if I'm even using spamassasin? when i do a ps aux, I see spamd running, but not a spamassasin pid.. is spamd the same?

Rob
_______________________________
Dave's Answer:
While I'm also a big fan of SpamAssassin, I'm the first to admit that the rules can be more than a bit confusing, and when you have a bad rule, odd things can occur, especially if you don't actually test your rules before you install them.

But let's start at the beginning...

Your local SpamAssassin rules should be stored in a file called /etc/mail/spamassassin/local.cf if you want the rules applied to every user on the system, or ~/.spamassassin/user_pref if you want to have them only apply to your own email. All rules have three components:

The rule itself
A 2-5 word description of the rule for SpamAssassin reports (optional),
A commensurate scoring for the rule if matched
As a simple example, here's a rule that applies against the body of messages that are being filtered:
body NO_VIOXX /vioxx/i
score NO_VIOXX 10
description NO_VIOXX messages that contain the word Vioxx
In this case, any message that contains "Vioxx" (without regard to the mix of upper and lower case, which is what the 'i' accomplishes in the pattern) will be given a score of +10, which might by itself make this an undelivered spam message (it actually depends on what threshold you specify in your configuration file).
Having shown that, I use rawbody rather than body so that it catches words that appear in HTML formatted messages and messages with base64 or any other encoding scheme. Here are two actual rules from my own SpamAssassin rule set:

rawbody BECAUSE_OPTIN /because you opted-in/i
score BECAUSE_OPTIN 5.0

rawbody DEALSMINUTE /dealsbytheminute/i
score DEALSMINUTE 5.0
The first thing you'll notice is that I don't bother with the description field. I just try to use sufficiently mnemonic rule names.
Don't be fooled into thinking that you can only match rules and have things be more spammy. You can do the opposite instead, as shown here:

header ITS_DEREK ALL =~ /derek\@farmprints.com/i
score ITS_DEREK -100
Finally, you can also reassign the scoring of built-in rules too, by simply restating the score:
score SUBJ_FREE_CAP 4.0
score FREE_PREVIEW 4.0
score HTTP_ESCAPED_HOST 4.0
Finally, don't forget to always run the command
spamassassin --lint
immediately after editing your configuration file to ensure that you haven't introduced any errors or typos into the ruleset!
If you'd still like more information on SpamAssassin, a good place to go is SpamAssassin Rule Help, and you can always pop over to the SpamAssassin site itself.
_______________________________________________