WOW... Matt you are a genius.. I have looked at that filter for over a week and did not even think of the tab.. YES there was a tab and that should explain it.
Now lets see if it works.. Thanks again for seeing what could not be seen.. Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, December 20, 2004 9:06 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Combo filter not working.. That should work. Would you please include your Global.cfg lines for the involved tests just to see if there is an oversight there. I also noted that following the first TESTSFAILED entry, there is a tab character following [SPF.FAIL]. If that tab exists within your filter file, that would be the issue. You should of course check all of the lines and make sure that no stray unintended characters follow. Matt Kami Razvan wrote: >Hi; > >I have one filter that is killing me and it just does not make sense >for it not to work. > >Here is an example of a message that should have triggered it but it >has not. > >======== Log file ======= >12/20/2004 04:52:48 Qa0e1026302703444 NOT bypassing whitelisting of >E-mail with weight >=25 (34) and at least 2 recipients (1). >12/20/2004 04:52:49 Qa0e1026302703444 L1 Message OK >12/20/2004 04:52:49 Qa0e1026302703444 Subject: $250 Shopping Gift Card >is pending shipping authorization: confirmation needed X3SFG45 >12/20/2004 04:52:49 Qa0e1026302703444 From: [EMAIL PROTECTED] To: >Joanna@<deleted>.org IP: 207.244.49.16 ID: 133E6507877 > >12/20/2004 04:52:49 Qa0e1026302703444 Tests failed [weight=34]: >[SPF.FAIL]=WARN [HELOBOGUS]=WARN [IPNOTINMX]=WARN [NOLEGITCONTENT]=WARN >[LONGSUBJ]=WARN [LINK.BODY]=IGNORE [COMBO.LINK]=WARN >[FILTER.SUBJECT.NUMBER]=IGNORE [SPAM.ENVELOPE]=WARN >WEIGHT-REDIRECT-SPAM-S=SUBJECT WEIGHT-REDIRECT-SPAM-R=ROUTETO >12/20/2004 04:52:49 Qa0e1026302703444 Last action = IGNORE. >====================== > >Here is the filter: > ># [Elevate.SPFFAIL] > >TESTSFAILED END NOTCONTAINS [SPF.FAIL] >TESTSFAILED END NOTCONTAINS [COMBO.LINK] > >TESTSFAILED 0 CONTAINS [NOLEGITCONTENT] >TESTSFAILED 0 CONTAINS [HEUR >TESTSFAILED 0 CONTAINS [REVDNS] > >======================= > >Based on the log file entries the following tests have failed: > >[SPF.FAIL]=WARN >[HELOBOGUS]=WARN >[IPNOTINMX]=WARN >[NOLEGITCONTENT]=WARN >[LONGSUBJ]=WARN >[LINK.BODY]=IGNORE >[COMBO.LINK]=WARN >[FILTER.SUBJECT.NUMBER]=IGNORE >[SPAM.ENVELOPE]=WARN >WEIGHT-REDIRECT-SPAM-S=SUBJECT >WEIGHT-REDIRECT-SPAM-R=ROUTETO > >Since [SPF.FAIL], [COMBO.LINK], and [NOLEGITCONTENT] have all failed >then I expect this filter to trigger. > >Any ideas why it is not? > >Regards, >Kami > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type >"unsubscribe Declude.JunkMail". The archives can be found at >http://www.mail-archive.com. > > > > -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
