Hi Todd,
A couple of suggestions
(?i:receive.*(postcard|greeting|ecard|e-card))
could also be written as:
(?i:receive.{0,50}(postcard|greeting|e.?card))
As you are checking anywhere you want to limit the amount of characters
between receive and the postcard etc. if you were using SUBJECT the .* would
be fine. Also the ecard|e-card is better written as e.?card that is
e.(anychar)?{0,1}card
Secondly (?i:ERMX) will produce false positives because of BASE64 encoding
which uses strings of "random" characters, it would be better to use the
word break which is \b so you could do it like (?i:\bERMX\b)
David
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 12:15 PM
To: [email protected]
Subject: RE: [Declude.JunkMail] PCRE tests
UGGH, it always takes sending something to a LOT of people for you to see
how dumb you are...
I thought I had the postcard test (which is what I had been troubleshooting)
set up for "ANYWHERE", but it's just looking in the body and probably not
finding a match. It's been more common on the Subject.
Let me change that and report back!
Todd
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 10:59 AM
To: [email protected]
Subject: RE: [Declude.JunkMail] PCRE tests
Hi David -
Yes, I just confirmed that I have 4.3.46. Below are two that I just put in.
By the way, I warn at 15, fail at 20, and delete at 45.
Thanks!
Todd
# for the postcard greetings that are going through (aka "You've received a
postcard from a Partner!")
BODY 10 PCRE
(?i:receive.*(postcard|greeting|ecard|e-card))
# for the stock spam coming through for ERMX (aka "Stock Watch ERMX")
BODY 20 PCRE (?i:ERMX)
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, July 06, 2007 10:18 AM
To: [email protected]
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you have version 4.3.46 of Declude. The format of an expression is:
LOCATION WEIGHT PCRE (EXPRESSION)
Eg.
BODY 5 PCRE (?i:Hello World)
Post some examples that you are using but not getting hits.
David
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 11:08 AM
To: [email protected]
Subject: [Declude.JunkMail] PCRE tests
Is there anything special that I need to have "turned on" to take advantage
of this? I've been playing around with it, and really like what it can do.
Being a complete newbie to regex, I've been using Regex Buddy to test the
expressions before putting them into "production". However, I'm not seeing
any hits in the emails.
I have not turned on logging (sorry!) but was wondering if I need to add any
additional information to the config files for this to be noticed, or if it
is by default. I am running the latest version.
Thanks!
Todd
---
This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
