I have noticed that a small change to Logger.pm could allow for a
value in $LOG_SA{facility} to override the 'all' setting, thereby
making it possible to enable 'all' but exclude certain facilities from
logging (e.g. to cut down debug clutter in areas not being investigated).
The change is compatible with existing code and usage, but allows for
example a command like: spamassassin --debug=all,norules,noconfig

I'm submitting a change to trunk, and attaching a patch for a review.
I hope you like it.  Here is an updated documentation to add_facilities():

=item add_facilities(facilities)

  Enable debug logging for specific facilities.  Each facility is the area
  of code to debug.  Facilities can be specified as a hash reference (the
  key names are used), an array reference, an array, or a comma-separated
  scalar string. Facility names are case-sensitive.

  If "all" is listed, then all debug facilities are implicitly enabled,
  except for those explicitly disabled.  A facility name may be preceded
  by a "no" (case-insensitive), which explicitly disables it, overriding
  the "all".  For example: all,norules,noconfig,nodcc.  When facility names
  are given as an ordered list (array or scalar, not a hash), the last entry
  applies, e.g. 'nodcc,dcc,dcc,noddc' is equivalent to 'nodcc'.  Note that
  currently no facility name starts with a "no", it is advised to keep this
  practice with newly added facility names to make life easier.

  Higher priority informational messages that are suitable for logging in
  normal circumstances are available with an area of "info".  Some very
  verbose messages require the facility to be specifically enabled (see
  C<would_log> below).