OK this is working now, sort of:
(?:LASHBACK\s|PSKY\s|NEWERDOMAIN\s|HEADERS\s|ROUTING\s|MAILSPIKE-L[1-5\s|HELO\s|SORBS\s|SPAMCOP\s|DNS\s){4,})
Here are examples
PSKY IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS SYMBOLSWORDSSUB
That is in the Delude Logs. BUT it only works if there are no breaks.
SO
PSKY NEWERDOMAIN ROUTING REVDNS IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS
SYMBOLSWORDSSUB BADHEADERS SORBS BADHELO
Only matches the first 4 but not BADHEADERS SORBS BADHELO
PSKY ROUTING REVDNS IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS
SYMBOLSWORDSSUB BADHEADERS SORBS BADHELO
DOES NOT WORK Finds no matches since it does not find 4 in a row of the above
choices, even though the entire string contains 6 of the above choices.
-----Original Message-----
From: "Andy Schmidt" <andy_schm...@hm-software.com>
Sent: Friday, August 26, 2016 4:05pm
To: community@mailsbestfriend.com
Subject: [MBF] Re: Help with PCRE
What is a sample of the actual string you are searching? Are there any
separation characters we need to allow for?
-----Original Message-----
From: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] On
Behalf Of John Tolmachoff
Sent: Friday, August 26, 2016 7:02 PM
To: community@mailsbestfriend.com
Subject: [MBF] Re: Help with PCRE
That is not working either. It is wanting them to be consecutive
-----Original Message-----
From: "David Barker" <david.bar...@mailsbestfriend.com>
Sent: Friday, August 26, 2016 11:32am
To: community@mailsbestfriend.com
Subject: [MBF] Re: Help with PCRE
Oooo, didn't think of doing it that way. Thought it only worked with letters.
So test to be sure. Just to correct the syntax Declude, you want to use the
following:
(?:(LASHBACK|PSKY|NEWERDOMAIN|HEADERS|ROUTING|MAILSPIKE-L|HELO|SORBS|SPAMCOP|DNS){4,})
David Barker
Mail’s Best Friend
Email : david.bar...@mailsbestfriend.com
Web : www.mailsbestfriend.com
Office : 866.919.2075
-----Original Message-----
From: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] On
Behalf Of Andy Schmidt
Sent: Friday, August 26, 2016 1:26 PM
To: community@mailsbestfriend.com
Subject: [MBF] Re: Help with PCRE
(?:LASHBACK|PSKY|NEWERDOMAIN|HEADERS|ROUTING|MAILSPIKE-L|HELO|SORBS|SPAMCOP|DNS){4,}
Move the quantifier OUTSIDE your token list.
-----Original Message-----
From: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] On
Behalf Of John Tolmachoff
Sent: Friday, August 26, 2016 1:47 PM
To: community@mailsbestfriend.com
Subject: [MBF] Help with PCRE
I am trying to create a Regex filter that will only trigger if 4 or more tests
have failed. This is what I have so far but it is not working:
(?i:LASHBACK|PSKY|NEWERDOMAIN|HEADERS|ROUTING|MAILSPIKE-L|HELO|SORBS|SPAMCOP|DNS{4,10})
It is triggering if only one has failed. I am trying to have it only trigger if
4 or more have failed.
Any suggestions?
John T
eServices For You
#############################################################
This message is sent to you because you are subscribed to
the mailing list <community@mailsbestfriend.com>.
To unsubscribe, E-mail to: <community-...@mailsbestfriend.com>
To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com>
To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com>
Send administrative queries to <community-requ...@mailsbestfriend.com>
#############################################################
This message is sent to you because you are subscribed to
the mailing list <community@mailsbestfriend.com>.
To unsubscribe, E-mail to: <community-...@mailsbestfriend.com>
To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com>
To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com>
Send administrative queries to <community-requ...@mailsbestfriend.com>
#############################################################
This message is sent to you because you are subscribed to
the mailing list <community@mailsbestfriend.com>.
To unsubscribe, E-mail to: <community-...@mailsbestfriend.com>
To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com>
To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com>
Send administrative queries to <community-requ...@mailsbestfriend.com>
#############################################################
This message is sent to you because you are subscribed to
the mailing list <community@mailsbestfriend.com>.
To unsubscribe, E-mail to: <community-...@mailsbestfriend.com>
To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com>
To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com>
Send administrative queries to <community-requ...@mailsbestfriend.com>
#############################################################
This message is sent to you because you are subscribed to
the mailing list <community@mailsbestfriend.com>.
To unsubscribe, E-mail to: <community-...@mailsbestfriend.com>
To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com>
To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com>
Send administrative queries to <community-requ...@mailsbestfriend.com>
