Then may I ask why prior to 2.0.6.12(or so) did the following work HEADER 1 CONTAINS gfsinc.com against the header information of:
Received: from mail.gfsinc.com [206.165.223.43] by bobcat.jcjc.edu (SMTPD32-8.15) id A9D24988001E; Wed, 09 Mar 2005 23:23:30 -0600 Now to catch this, I have to use HEADER 1 CONTAINS mail.gfsinc.com So if gfsinc.com changes to mail2.gfsinc.com, it is not caught. John -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, July 26, 2005 12:27 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Filter not triggering Nick, I am not aware of any bugs with the CONTAINS filter statement. However there are some items on our wish list, currently CONTAINS searches for a string eg. ABC So this will trigger XXXABCXXX Currently there is not a way to use CONTAINS with <SPACE>ABC as the config file does not see the space as in BODY 10 CONTAINS <SPACE>ABC Because we allow for spaces between CONTAINS and the text. We are looking into providing a way where you can include spaces such as: BODY 10 CONTAINS " ABC" *Please note <SPACE> is not syntax it is just there so you can see the space I am talking about :) David B www.declude.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, July 26, 2005 1:19 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Filter not triggering Hi David, Are you aware of any bugs with the CONTAINS filter statement? Thanks! -Nick David Barker wrote: >Kevin, > >After reviewing your files you had sent me this is the problem you are >having: > >1. The email you received was encoded in BASE64 (Msg failed BASE64) > >2. In your global.cfg you have the following directive: > >DECODE OFF > >Therefore your STOCKFILTER did not trigger - as nowhere in the encoded >text of the email is the following phrase (OTC: > >In order for your filters to work on encoded messages I would suggest >commenting out #DECODE OFF > >David B >www.declude.com > >________________________________ > >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee >Sent: Monday, July 25, 2005 10:10 AM >To: JunkMail Declude >Subject: [Declude.JunkMail] Filter not triggering > > >The attached email is not getting trapped by my STOCKFILTER??? Here are >the log lines. They do not indicate any issues with the STOCKFILTER. In >the STOCKFILTER this line should be hitting > >BODY 10 CONTAINS (OTC: > >Any idea why this email is not triggering this line and assigning 10 >points???? Could declude not be decoding the BASE64???? This also seems >to be an intermittent issue! > > >07/24/2005 19:57:36 Q551E097C00000333 Filter HELOFILTER: Not skipping >E-mail due to current weight of 2. >07/24/2005 19:57:36 Q551E097C00000333 Filter VIRUSTRAP: Not skipping >E-mail due to current weight of 2. >07/24/2005 19:57:36 Q551E097C00000333 Filter REVDNSFILTER: Not skipping >E-mail due to current weight of 2. >07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 19. >07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 13. >07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 14. >07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 5. >07/24/2005 19:57:36 Q551E097C00000333 Filter STOCKFILTER: Not skipping >E-mail due to current weight of 2. >07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 15. >07/24/2005 19:57:36 Q551E097C00000333 Filter BODYFILTER: Not skipping >E-mail due to current weight of 2. >07/24/2005 19:57:36 Q551E097C00000333 NOABUSE:2 . Total weight = 2. >07/24/2005 19:57:36 Q551E097C00000333 Using [incoming] CFG file >D:\IMAIL\Declude\$default$.junkmail. >07/24/2005 19:57:36 Q551E097C00000333 Redirecting >[EMAIL PROTECTED] to file >D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. >07/24/2005 19:57:36 Q551E097C00000333 Msg failed NOABUSE ("Not >supporting [EMAIL PROTECTED]"). Action=WARN. >07/24/2005 19:57:36 Q551E097C00000333 Msg failed BASE64 (A binary >encoded text or HTML section was found in this E-mail.). Action=WARN. >07/24/2005 19:57:36 Q551E097C00000333 L1 Message OK >07/24/2005 19:57:36 Q551E097C00000333 Subject: Stocks in Play >07/24/2005 19:57:36 Q551E097C00000333 From: >[EMAIL PROTECTED] >To: [EMAIL PROTECTED] IP: 200.182.78.150 ID: >M2005072419564304108 > >07/24/2005 19:57:36 Q551E097C00000333 Tests failed [weight=2]: >NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE >07/24/2005 19:57:36 Q551E097C00000333 Action(s) taken for >[copyall_account] = IGNORE WARN [LAST ACTION=WARN] >07/24/2005 19:57:36 Q551E097C00000333 Using [incoming] CFG file >D:\IMAIL\Declude\$default$.junkmail. >07/24/2005 19:57:36 Q551E097C00000333 Redirecting >[EMAIL PROTECTED] to file >D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. >07/24/2005 19:57:36 Q551E097C00000333 Msg failed NOABUSE ("Not >supporting [EMAIL PROTECTED]"). Action=WARN. >07/24/2005 19:57:36 Q551E097C00000333 Msg failed BASE64 (A binary >encoded text or HTML section was found in this E-mail.). Action=WARN. >07/24/2005 19:57:36 Q551E097C00000333 L2 Message OK >07/24/2005 19:57:36 Q551E097C00000333 Subject: Stocks in Play >07/24/2005 19:57:36 Q551E097C00000333 From: >[EMAIL PROTECTED] >To: [EMAIL PROTECTED] >[EMAIL PROTECTED] >IP: 200.182.78.150 ID: M2005072419564304108 > >07/24/2005 19:57:36 Q551E097C00000333 Tests failed [weight=2]: >NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE >07/24/2005 19:57:36 Q551E097C00000333 Action(s) taken for >[EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] >07/24/2005 19:57:36 Q551E097C00000333 Cumulative action(s) taken on >this email = IGNORE WARN [LAST ACTION=WARN] > > > >Kevin Bilbee > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type >"unsubscribe Declude.JunkMail". The archives can be found at >http://www.mail-archive.com. > > > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
