* ^X-Spam-Bar: \*\*\*\*\*\*\*\*
/var/spool/mail/spam
If you want a second mailbox for email messages that have fewer asterisks but are still potential spam, you can create a second rule that sends email scoring 5 or more to a different mailbox (in this example named possible_spa)):
:0:
* ^X-Spam-Bar: \*\*\*\*\*
/var/spool/mail/possible_spam
Note that this recipe must follow the first recipe because Procmail runs filters in the order they are listed in the .procmailrc file. If you reverse the order of the recipes, then the 5-or-more asterisk recipe would also catch emails that are in the smaller 8-or-more asterisk range.
If your users create their own procmail rules in their home directories, then they can also sort their email based on the X-Spam-Bar header.
PATH=/bin:/usr/bin:/usr/local/bin
MAILDIR=$HOME/mail
PMDIR=$HOME/.procmail
LOGFILE=$PMDIR/log
INCLUDERC=$PMDIR/general.rc
:0:
* ^X-Spam-Bar:
(followed by the pattern of 'escaped' asterisks that the recipe will minimally match against)
mailbox_name
For example, the following recipes would send email with 5 asterisks or more to a mailbox called 'sspam' (suspected spam) in the $HOME/mail directory.
:0:
* ^X-Spam-Bar: \*\*\*\*\*
sspam
The user can create similar recipes if they want to move messages with a higher number of asterisks to a separate mailbox. Again, the order of the recipes is important. Make sure that any recipes that filter on a higher number of asterisks are placed before the recipes that filter on a lower number of asterisks.