Can you help me with this filter

[Linspeed <le...@linspeed.com>]

Hello

I've just started using SpamAssassin this morning.

In my procmailrc file, I have this at the top:

:0fw: spamassassin.lock
* < 512000
| spamassassin

i.e. the recommended default.

Works perfectly OK. From there on, I have a lot of other filters, again all
working.

However, for a certain string in the subject, I want it to bypass
SpamAssassin.
That string is [WL]. We've been doing that for years on our existing
anti-spam system and nobody has ever sent us spam with [WL] in the subject.

So I change the filter:

:0fw: spamassassin.lock
* < 512000
* !Subject: .*[wl].*
| spamassassin


But it does not work. I've even changed it so that it filters all messages
no matter the size:

:0fw: spamassassin.lock
* !Subject: .*[wl].*
| spamassassin


Problem here is that some messages bypass SpamAssassin even when they
*don't* have [WL] in the subject.

Can somebody tell me where I am going wrong.

I am rubbish with syntax!
-- 
View this message in context: http://www.nabble.com/Can-you-help-me-with-this-filter-tp18255552p18255552.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Can you help me with this filter

[Karsten Bräckelmann <gu...@rudersport.de>]

On Thu, 2008-07-03 at 06:28 -0500, McDonald, Dan wrote:
> On Thu, 2008-07-03 at 02:38 -0700, Linspeed wrote:
> > However, for a certain string in the subject, I want it to bypass
> > SpamAssassin.
> > That string is [WL]. We've been doing that for years on our existing
> > anti-spam system and nobody has ever sent us spam with [WL] in the subject.
> > 
> > So I change the filter:
> > 
> > :0fw: spamassassin.lock
> > * < 512000
> > * !Subject: .*[wl].*
> 
> Since this is a regular expression, and character classes are enclosed
> in brackets, any subject with a "w" or "l" in the subject would be
> excluded.  You will need to escape the brackets so that they don't
> designate a character class:
> 
> !Subject: .*\[WL\].*

Very true. :)  Also, since you don't care about the trailing string,
don't make procmail waste effort on matching it. Just drop the trailing
"any char, and number of times".

You're using the correct approach to exempt specific messages from
matching the filter. However, if you are using server-side filters
delivering these internal messages to dedicated folders, you could just
as well change the order of the procmail receipts. First deliver those
messages that you don't want to be scanned by SA, then call SA for the
rest of the bulk that hasn't been delivered yet...


General note:  If you feel the need to run SA, you most likely want to
use spamc/spamd instead of spawning a costly spamassassin process for
every mail to scan.

  guenther


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: Can you help me with this filter

["McDonald, Dan" <Da...@austinenergy.com>]

On Thu, 2008-07-03 at 02:38 -0700, Linspeed wrote:
> However, for a certain string in the subject, I want it to bypass
> SpamAssassin.
> That string is [WL]. We've been doing that for years on our existing
> anti-spam system and nobody has ever sent us spam with [WL] in the subject.
> 
> So I change the filter:
> 
> :0fw: spamassassin.lock
> * < 512000
> * !Subject: .*[wl].*

Since this is a regular expression, and character classes are enclosed
in brackets, any subject with a "w" or "l" in the subject would be
excluded.  You will need to escape the brackets so that they don't
designate a character class:

!Subject: .*\[WL\].*

-- 
Daniel J McDonald, CCIE #2495, CISSP #78281, CNX
Austin Energy
http://www.austinenergy.com