Thanks Andy. You come through again. I will be testing and will let you know
how it goes.
-----Original Message-----
From: "Andy Schmidt" <andy_schm...@hm-software.com>
Sent: Friday, August 26, 2016 5:10pm
To: community@mailsbestfriend.com
Subject: [MBF] Re: Help with PCRE
Uh - okay. The problem is NOT the order (or the fact that the last item
wouldn't have a whitespace character, which could be handled easily).
The real problem is that a match will ONLY be made if every single "token" in
your string is actually included in your list of alternatives. The problem is
that I see now that you have OTHER tokens in your string that are NOT in your
list - which your RegEx does not permit.
The following works with all your examples:
(((\S*\s)*(LASHBACK|PSKY|NEWERDOMAIN|HEADERS|ROUTING|MAILSPIKE-L|HELO|SORBS|SPAMCOP|DNS)\s?){4,})
This is NOT matched, because there are not four of them:
PSKY IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS SYMBOLSWORDSSUB
This IS matching PSKY, NEWERDOMAIN, ROUTING, SORBS:
PSKY NEWERDOMAIN ROUTING REVDNS IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS
SYMBOLSWORDSSUB BADHEADERS SORBS BADHELO
This is NOT matched, because it only matches PSKY, ROUTING and SORBS:
PSKY ROUTING REVDNS IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS
SYMBOLSWORDSSUB BADHEADERS SORBS BADHELO
Please note, that at present it will only match FULL words - so " BADHELO " is
NOT a match for " HELO ", " BADHEADERS " is NOT a match for " HEADERS ", etc.
-----Original Message-----
From: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] On
Behalf Of John Tolmachoff
Sent: Friday, August 26, 2016 7:25 PM
To: community@mailsbestfriend.com
Subject: [MBF] Re: Help with PCRE
OK this is working now, sort of:
(?:LASHBACK\s|PSKY\s|NEWERDOMAIN\s|HEADERS\s|ROUTING\s|MAILSPIKE-L[1-5\s|HELO\s|SORBS\s|SPAMCOP\s|DNS\s){4,})
Here are examples
PSKY IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS SYMBOLSWORDSSUB
That is in the Delude Logs. BUT it only works if there are no breaks.
SO
PSKY NEWERDOMAIN ROUTING REVDNS IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS
SYMBOLSWORDSSUB BADHEADERS SORBS BADHELO Only matches the first 4 but not
BADHEADERS SORBS BADHELO
PSKY ROUTING REVDNS IPNOTINMX MSGSIZE-0KB MSGSIZE-3KB ALLIGATETESTS
SYMBOLSWORDSSUB BADHEADERS SORBS BADHELO DOES NOT WORK Finds no matches since
it does not find 4 in a row of the above choices, even though the entire string
contains 6 of the above choices.
#############################################################
This message is sent to you because you are subscribed to
the mailing list <community@mailsbestfriend.com>.
To unsubscribe, E-mail to: <community-...@mailsbestfriend.com>
To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com>
To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com>
Send administrative queries to <community-requ...@mailsbestfriend.com>
#############################################################
This message is sent to you because you are subscribed to
the mailing list <community@mailsbestfriend.com>.
To unsubscribe, E-mail to: <community-...@mailsbestfriend.com>
To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com>
To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com>
Send administrative queries to <community-requ...@mailsbestfriend.com>
