I have always noticed when I set my email to get all lfd alerts and dont filter any to spam that it constantly fires on spamd child.
I have tried adding this to process ignore:
exe:/usr/bin/spamd
cmd:spamd
To no avail.
At the time of this post, I just added:
pcmd:/usr/bin/spamd*
So I will see if it fires on that. Spamd is pretty common thing so I think it should be added to the default ignore list.