Yes order does matter. If you are using a TESTSFAILED comparison, the TEST you are wanting to compare needs to be run first. So in this case the mailfrom-null-sender filter must run first. Then I run the joe-job filters. Lastly a combo filter with Message Sniffer and the joe-job filter to lob on more weight.
So user-joe-job will only fail, if the mailfrom-null-sender has already true (failed) My general rule for filters is to run the small tests first and the big tests last. So mailfrom, HELO, country, revdsn I consider small tests because there isn't much to compare and it should run quicker. Header and subject are middle tests Body and Anything are the last filters tests that I run, hoping that enough weight is accumulated to skip them. ---------- Original Message ---------------------------------- From: "Kim Premuda" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Thu, 11 Nov 2004 15:20:14 -0800 >Thanks Scott and Matt for clearing up the '<>' issue...it's a far better >approach than what I was attempting. > >Scott... > >What is the interaction between your two tests, MAILFROM-NULL-SENDER and >USER-JOE-JOB? The reason I am asking is that I can only get >MAILFROM-NULL-SENDER to trigger and not the user-specific USER-JOB-JOB test. >It appears to me that they are mutually exclusive tests: > > Mailfrom-Null-sender.txt: > TESTSFAILED 1 CONTAINS USER-JOE-JOB > > user-joe-job.txt: > TESTSFAILED END NOTCONTAINS MAILFROM-NULL-SENDER > > > MAILFROM-NULL-SENDER does not fail unless USER-JOE-JOB also fails > > but > > USER-JOE-JOB ends if MAILFROM-NULL-SENDER hasn't already failed > > >It's kinda like a catch 22 sort of thing. Is my logic wrong? > >Which brings me to another question...does the order in which the tests appear >in the 'global.config' file matter? > >Thanks! > >Kim > > >-- >Kim W. Premuda >FastWave Internet Services >San Diego, CA > >-- >--- >[This E-mail scanned for viruses by Declude Virus] > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
