I'm still not having any luck with it. It recognizes '' as spamlover and the .*? Hammers the cpu to the point of bringing assp to its knees.
Thanks anyway :) Paul K. Dickson Systems Administrator Interagency Information Technologies Frederick County Government Frederick, MD 21701 pdick...@frederickcountymd.gov 301-600-2399/x12399 > From: Thomas Eckardt <thomas.ecka...@thockar.com> > Reply-To: ASSP development mailing list <assp-test@lists.sourceforge.net> > Date: Wed, 26 May 2010 07:12:30 +0200 > To: ASSP development mailing list <assp-test@lists.sourceforge.net> > Subject: Re: [Assp-test] Way to ignore spamloverre via another regex? > > Paul, > >> \bred\b)).*?(?!\g{-1})){3}) > > notice the '3' - which meens, that three bad words must occur in the mail > to be not spamlover > > There is a (non) magic logic behind. > > assume we have three bad words defind: black yellow green > > counted (only the count is relevant) will be a bad word, if this word > follows not the same word > > so: > > black black black -> 1 > black black yellow ->2 > yellow black black ->2 > yellow yellow black black -> 2 > > but > > black yellow black ->3 > yellow black black green ->3 > yellow black black yellow ->3 > yellow black green -> 3 > black green black green black green ->6 > > any text between the words plays no rule > the search will be stopped, if the count number (here 3) is reached > > Thomas > > > > Von: "Paul K. Dickson" <pdick...@frederickcountymd.gov> > An: ASSP development mailing list <assp-test@lists.sourceforge.net> > Datum: 25.05.2010 20:42 > Betreff: Re: [Assp-test] Way to ignore spamloverre via another > regex? > > > > Thomas: > > No luck. Something is amiss with the bad words part. Web interface and > sending emails still matches even if the mail has a bad word from the bad > word section in it. > > > I sent an email with "great!" and "puke" in it and it was recognized as > spamlover. Just to make sure I was assessing correctly I sent the same > email again but with lots of nasty words that are in bombre. I still got > the "spam but passing because spamlover blah blah blah". > > It see's "puke" and reports a spamlover match. > > > > > Here is what I have of your suggestion: > > #assp-do-not-optimize-regex > # if you use V2 - > # write the line above anywhere > # to prevent assp from trying > # to optimize this file (regex) > # > # any regex of your choice > #.... > #.... > ### begin of the selection part > # the first good word must be > # at the end of the first line > (?=.*?(\bblue\b > \bgreat\!\b > #another word > #.... > # any regex is possible in this part > #.... > #additional word(s) > #.... > # the last good and the first bad > # word must be in this line > # at the begin and end > \bwhite\b))(?!.*?(?:(\b(?:\bblack\b > > \bpuke\b > > > #.... > # You may also include some other file with some > # realy bad words (e.g.) > # include files/blackre.txt > #.... > # the last bad word must be > # at the begin of this line > \bred\b)).*?(?!\g{-1})){3}) > > > ### end of the selection part > # now can follow the next/different part > # of the regex - > # if you want, in the same way like above > > > > > > Here is the log with the bad bad word starred out: > > > > May-25-10 14:29:09 12148-10442 [OKAddress] 74.125.82.48 > <paulkdick...@gmail.com> to: pdick...@frederickcountymd.gov [scoring:-5] > sender in OK Address Cache, counter = 10; > May-25-10 14:29:09 12148-10442 [BombBlack] 74.125.82.48 > <paulkdick...@gmail.com> to: pdick...@frederickcountymd.gov [scoring:20] > -- > blackRe: '****** (20)' -- [Fwd test bad]; > May-25-10 14:29:09 12148-10442 74.125.82.48 <paulkdick...@gmail.com> to: > pdick...@frederickcountymd.gov Regex:SpamLover 'puke'; > May-25-10 14:29:09 12148-10442 [BombRaw] 74.125.82.48 > <paulkdick...@gmail.com> to: pdick...@frederickcountymd.gov [spam passed] > -- > passing because spamlover, otherwise blocked (bombRe: '***** (30)') -- > [Fwd > test bad] -> /usr/local/assp/spam/10442.eml; > > > > > >> From: Thomas Eckardt <thomas.ecka...@thockar.com> >> Reply-To: ASSP development mailing list > <assp-test@lists.sourceforge.net> >> Date: Tue, 25 May 2010 16:45:42 +0200 >> To: ASSP development mailing list <assp-test@lists.sourceforge.net> >> Subject: Re: [Assp-test] Way to ignore spamloverre via another regex? >> >> Paul, >> >> make your spamloversRe file this way. >> >> <START> >> assp-do-not-optimize-regex >> # if you use V2 - >> # write the line above anywhere >> # to prevent assp from trying >> # to optimize this file (regex) >> .... >> # any regex of your choice >> .... >> .... >> ### begin of the selection part >> # the first good word must be >> # at the end of the first line >> (?=.*?(\bblue\b >> another word >> .... >> # any regex is possible in this part >> .... >> additional word(s) >> .... >> # the last good and the first bad >> # word must be in this line >> # at the begin and end >> \bwhite\b))(?!.*?(?:(\b(?:\bblack\b >> \byellow\b >> .... >> \bgreen\b >> .... >> # You may also include some other file with some >> # realy bad words (e.g.) >> # include files/blackre.txt >> .... >> # the last bad word must be >> # at the begin of this line >> \bred\b)).*?(?!\g{-1})){3}) >> ### end of the selection part >> # now can follow the next/different part >> # of the regex - >> # if you want, in the same way like above >> .... >> .... >> <EOF> >> >> Not absolute sure, but I think it works. This way you have it as > flexible >> as possible. >> You can add and delete words like before. >> >> Thomas >> >> >> >> Von: "Paul K. Dickson" <pdick...@frederickcountymd.gov> >> An: ASSP development mailing list <assp-test@lists.sourceforge.net> >> Datum: 25.05.2010 15:53 >> Betreff: Re: [Assp-test] Way to ignore spamloverre via another >> regex? >> >> >> >>> I think this methode is better than having a 'notSpamLoversRe', because >> a >>> matching entry in this 'notSpamLoversRe' will revert every matched >>> spamloverRe entry - not only one. >> >> Thanks for the suggestion. However I'd rather have something like a >> notspamloverre because otherwise I'd have to enter that regex, often > times >> almost duplicated, all over the place. Easier just to put it once in > one >> file IMO. To each their own :) >> >> >> Paul K. Dickson >> Systems Administrator >> Interagency Information Technologies >> Frederick County Government >> Frederick, MD 21701 >> pdick...@frederickcountymd.gov >> 301-600-2399/x12399 >> >> >> >>> From: Thomas Eckardt <thomas.ecka...@thockar.com> >>> Reply-To: ASSP development mailing list >> <assp-test@lists.sourceforge.net> >>> Date: Tue, 25 May 2010 15:45:51 +0200 >>> To: ASSP development mailing list <assp-test@lists.sourceforge.net> >>> Subject: Re: [Assp-test] Way to ignore spamloverre via another regex? >>> >>> Paul, you can try the following regular expression in spamLoverRe: >>> >>> >> > (?=.*?\b(good1|good2|good3)\b)(?!.*?(?:(\b(?:bad1|bad2|bad3|bad4)\b).*?(?!\g{- >>> 1})){digit >>> of bad count}) >>> >>> where good1, good2, good3 are the good words, which consider > 'spamlover' >>> >>> but only >>> >>> if the bad words bad1, bad2, bad3, bad4 will not be found a 'digits of >>> bad count' times >>> >>> for example: >>> >>> If you want to consider a mail 'spamlover', if it contains any of the >>> words 'blue' or 'white' - >>> but not if it contains additional 'black' , 'yellow' , 'green' , 'red' >> (in >>> any combination) at least three times - than >>> >>> >> > (?=.*?\b(blue|white)\b)(?!.*?(?:(\b(?:black|yellow|green|red)\b).*?(?!\g{-1})) >>> {3}) >>> >>> should do it. >>> >>> I think this methode is better than having a 'notSpamLoversRe', because >> a >>> matching entry in this 'notSpamLoversRe' will revert every matched >>> spamloverRe entry - not only one. >>> >>> >>> >>> Thomas >>> >>> >>> >>> Von: "Paul K. Dickson" <pdick...@frederickcountymd.gov> >>> An: ASSP development mailing list <assp-test@lists.sourceforge.net> >>> Datum: 24.05.2010 21:43 >>> Betreff: [Assp-test] Way to ignore spamloverre via another > regex? >>> >>> >>> >>> I there a way to do that? For instance, I want 90% of mail to be spam >>> lover >>> that contains word N. However, there are a fair amount of mails that >> come >>> in that have word N in it that are also obviously spam by other vulgar >>> words >>> in them. >>> >>> So I¹m in a bit of a catch 22 situation. Love all mail w/ word N in it >> no >>> matter how vulgar or spammy, resulting in 10% of it being nasty spam, > or >>> remove word N from spamloverre and risk getting mail I want tagged but >>> passed completely blocked. >>> >>> >>> >>> Is there a way to say ³use spamloverre EXCEPT if it contains X bad >>> word(s)²? >>> >>> >>> >>> >>> Paul K. Dickson >>> Systems Administrator >>> Interagency Information Technologies >>> Frederick County Government >>> Frederick, MD 21701 >>> pdick...@frederickcountymd.gov >>> 301-600-2399/x12399 >>> >>> >>> >> > ------------------------------------------------------------------------------ >>> >>> _______________________________________________ >>> Assp-test mailing list >>> Assp-test@lists.sourceforge.net >>> https://lists.sourceforge.net/lists/listinfo/assp-test >>> >>> >>> >>> DISCLAIMER: >>> ******************************************************* >>> This email and any files transmitted with it may be confidential, >> legally >>> privileged and protected in law and are intended solely for the use of >> the >>> >>> individual to whom it is addressed. >>> This email was multiple times scanned for viruses. There should be no >>> known virus in this email! >>> ******************************************************* >>> >>> >>> >> > ------------------------------------------------------------------------------ >>> >>> _______________________________________________ >>> Assp-test mailing list >>> Assp-test@lists.sourceforge.net >>> https://lists.sourceforge.net/lists/listinfo/assp-test >> >> >> > ------------------------------------------------------------------------------ >> >> _______________________________________________ >> Assp-test mailing list >> Assp-test@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/assp-test >> >> >> >> >> DISCLAIMER: >> ******************************************************* >> This email and any files transmitted with it may be confidential, > legally >> privileged and protected in law and are intended solely for the use of > the >> >> individual to whom it is addressed. >> This email was multiple times scanned for viruses. There should be no >> known virus in this email! >> ******************************************************* >> >> >> > ------------------------------------------------------------------------------ >> >> _______________________________________________ >> Assp-test mailing list >> Assp-test@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/assp-test > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Assp-test mailing list > Assp-test@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/assp-test > > > > > DISCLAIMER: > ******************************************************* > This email and any files transmitted with it may be confidential, legally > privileged and protected in law and are intended solely for the use of the > > individual to whom it is addressed. > This email was multiple times scanned for viruses. There should be no > known virus in this email! > ******************************************************* > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Assp-test mailing list > Assp-test@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/assp-test ------------------------------------------------------------------------------ _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test