A simple procmail problem...

[Kenneth Andresen <ke...@cancun.net>]

Hello all

I have am tired of all the incorrect messages with virus in the subject
line, and set up the following filter to filter them out.

:0
* ^Subject. virus | Virus
virus-in-subject


The problem is that is is not working as expected... What am I doing
wrong? - it is removing much more messages than what it should:

cat ./virus-in-subject | grep ^Subj

Subject: CONGRATULATIONS ! You have been issued Coupon # 84
Subject: Ïðèåçæàéòå ê íàì
Subject: McAfee 8.0 - Best Price!
Subject: McAfee 8.0 - Best Price!
Subject: NAV detected a virus in a document you authored.
(just a short extract)

of these 5 messages I only expected to filter the last one. There are no
other filter going to the virus-in-subject file, so the filter must be
wrong. Anyone who may help me?

Re: A simple procmail problem...

["Adam D. Lopresto" <ad...@pubcrawler.org>]

On Mon, 10 May 2004, Sandy S wrote:

> You'll probably need to place () in your rule - as it is now it looks like
> you're filtering for two strings:
> "Subject. virus" and "Virus" - in other words, if the word Virus is anywhere
> in the message (not just in the Subject) it will get filtered.

Well, anywhere in the headers.

> Try this:
> :0
> * ^Subject.*(virus|Virus)
> virus-in-subject
>
> This should work, too:
> :0
> * ^Subject.*[vV]irus
> virus-in-subject

Or just

:0
* ^Subject:.*virus
virus-in-subject

since procmail is case-insensitive by default.  (Though I'd recommend ":0:" for
the first line, to provide locking.)
-- 
Adam Lopresto
http://cec.wustl.edu/~adam/

"Yet creeds mean very little," Coth answered the dark god, still speaking
almost gently.  "The optimist proclaims that we live in the best of all
possible worlds; and the pessimist fears this is true."

--James Cabell, "The Silver Stallion."

Re: A simple procmail problem...

[Kenneth Andresen <ke...@cancun.net>]

Thanks all!

It works correctly now!


On Mon, 2004-05-10 at 12:54, Steve Thomas wrote:
> On Mon, May 10, 2004 at 12:47:22PM -0500, Sandy S is rumored to have said:
> > 
> > > :0
> > > * ^Subject. virus | Virus
> > > virus-in-subject
> > >
> > You'll probably need to place () in your rule - as it is now it looks like
> > you're filtering for two strings:
> > "Subject. virus" and "Virus" - in other words, if the word Virus is anywhere
> > in the message (not just in the Subject) it will get filtered.
> > 
> > Try this:
> > :0
> > * ^Subject.*(virus|Virus)
> > virus-in-subject
> > 
> > This should work, too:
> > :0
> > * ^Subject.*[vV]irus
> > virus-in-subject
> 
> Procmail rules are case insensitive by default. The "D" flag turns on case sensitivity. It also only checks the headers unless the 'B' flag is specified, so "virus" is appearing somewhere else in the headers, not (necessarily) the body.
> 
> This should be all you need:
> 
> :0:
> * ^subject:.*virus
> virus-in-subject
> 
> Note the colon at the end of the first line - it tells procmail to create a lockfile, so two processes writing to the same mailbox won't clobber each other and corrupt the mailbox.
> 
> HTH,
> Steve
> 

Re: A simple procmail problem...

[Steve Thomas <li...@sthomas.net>]

On Mon, May 10, 2004 at 12:47:22PM -0500, Sandy S is rumored to have said:
> 
> > :0
> > * ^Subject. virus | Virus
> > virus-in-subject
> >
> You'll probably need to place () in your rule - as it is now it looks like
> you're filtering for two strings:
> "Subject. virus" and "Virus" - in other words, if the word Virus is anywhere
> in the message (not just in the Subject) it will get filtered.
> 
> Try this:
> :0
> * ^Subject.*(virus|Virus)
> virus-in-subject
> 
> This should work, too:
> :0
> * ^Subject.*[vV]irus
> virus-in-subject

Procmail rules are case insensitive by default. The "D" flag turns on case sensitivity. It also only checks the headers unless the 'B' flag is specified, so "virus" is appearing somewhere else in the headers, not (necessarily) the body.

This should be all you need:

:0:
* ^subject:.*virus
virus-in-subject

Note the colon at the end of the first line - it tells procmail to create a lockfile, so two processes writing to the same mailbox won't clobber each other and corrupt the mailbox.

HTH,
Steve


-- 
"The difference between pornography and erotica is lighting." 
- Gloria Leonard 

Re: A simple procmail problem...

[Sandy S <sa...@boreal.org>]

----- Original Message ----- 
From: "Kenneth Andresen" <ke...@cancun.net>
To: "Spamassassin Questions" <sp...@incubator.apache.org>
Sent: Monday, May 10, 2004 12:28 PM
Subject: A simple procmail problem...


> Hello all
>
> I have am tired of all the incorrect messages with virus in the subject
> line, and set up the following filter to filter them out.
>
> :0
> * ^Subject. virus | Virus
> virus-in-subject
>
>
> The problem is that is is not working as expected... What am I doing
> wrong? - it is removing much more messages than what it should:
>
> cat ./virus-in-subject | grep ^Subj
>
> Subject: CONGRATULATIONS ! You have been issued Coupon # 84
> Subject: Ïðèåçæàéòå ê íàì
> Subject: McAfee 8.0 - Best Price!
> Subject: McAfee 8.0 - Best Price!
> Subject: NAV detected a virus in a document you authored.
> (just a short extract)
>
> of these 5 messages I only expected to filter the last one. There are no
> other filter going to the virus-in-subject file, so the filter must be
> wrong. Anyone who may help me?
>
>
>
>
You'll probably need to place () in your rule - as it is now it looks like
you're filtering for two strings:
"Subject. virus" and "Virus" - in other words, if the word Virus is anywhere
in the message (not just in the Subject) it will get filtered.

Try this:
:0
* ^Subject.*(virus|Virus)
virus-in-subject

This should work, too:
:0
* ^Subject.*[vV]irus
virus-in-subject

Sandy