OK I think I have figured out at least a portion of this puzzle. I spent
over an hour on the phone with a very knowledgeable Imail technician this
morning. We did many test emails, he sent me emails with a .v$b$s file
attached. This is rule I was using:
B~filename=".*\.v$b$s":filtered (actual rule has "$" removed)
This rule would catch his emails, but it would not catch emails that I sent,
(routed to an SMTP server outside my domain). This was very puzzling to us.
Upon examining the actual raw header text of the emails, we found that they
were different. He was sending his emails from outlook express and I from
Outlook 2000. I'm not sure what these two programs do different to emails
and attachments, but something.
We then modified the rule to look at the header, instead of the body, and lo
and behold it caught emails from either program!
New rule: H~filename=".*\.v$b$s":filtered (actual rule has "$" removed)
So just to be on the safe side, I've put a rule in place for both body and
header.
Anyone know anything about why the first rule would catch an outlook express
email with .v$b$s attachment, but not one from Outlook 2000?
This makes me a bit concerned about emails from the many other clients out
there...
Dan
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Gordon Williams
Sent: Friday, May 19, 2000 1:16 PM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] problem with rules.ima
Great suggestion (tag in header RE which rule matched)!
As for the filename= thing, until this morning, that is the ONLY
rule I had in place -- and I've been catching v b s files (real
ILY attachments)! It works like a charm for me.
Since it doesn't work for at least several other folks, however,
there must be some other variable that interacts with the rules.
Dan has had exactly the right syntax for two weeks, but it won't
work for him. I wonder if we need to do a better job of briefly
describing our systems? Maybe that would help spot a pattern.
(Thanks for IMFilter, by the way!)
Gordon
-----
Madscientist wrote:
>
> It would be nice to know that you really caught these with the filename=
and
> not some other rule you may have in place.
>
> I keep asking IPSwitch to include a tag in the header of messages that are
> redirected by their rules so that we can look at the header and see which
> rule fired to move the message. That would really clear up this confusion,
> and would help when fixing rules that catch things we don't want to catch.
>
> It seems like such a simple thing. I wish they weren't so deaf.
>
> Maybe if a few more people ask for this they'll hear it.
>
> ----- Original Message -----
> From: Jonathan <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Friday, May 19, 2000 13:57
> Subject: Re: [IMail Forum] problem with rules.ima
>
> > That's really strange, to my knowledge, filename = has worked relatively
> > reliably for us - at least to my knowledge. We've caught a few with it,
> and
> > I haven't heard any disaster reports -- I just assumed we were getting
> all
> > there was to be had ..
> >
> > Jonathan
> >
> > At 11:44 AM 5/19/2000 -0600, you wrote:
> > >On 11:22 AM 05/19/2000 -0600, it would appear that Dan Spangenberg
wrote:
> > >>My rules.ima file is setup and working fine, it will catch and forward
> based
> > >>on keywords just as it should.
> > >>But I can't seem to get a rule in that will correctly filter any
.v$b$s
> > >>file.
> > >>
> > >>I have tried the many different versions posted here, but none seem to
> work.
> > >>I want to filter out any and all .v$b$s files
> > >>
> > >>I currently have the following:
> > >>
> > >>B~filename=".*\.v$b$s":filtered
> > >>
> > >>(remove all the $ above to see what I actually am using)
> > >>
> > >>Any ideas?
> > >
> > >We have been unable to get the "filename=" identifier to function
> > >reliably. As such, we use
> > >B~\p v b s:virus sans spaces of course. We use \p as /. also does not
> > >appear to work correctly and a simple . will act as a wildcard causing
> the
> > >search to be too exhaustive and all inclusive; in short, using . caused
> > >too many false catches.
> > >
> > >Tyran Ormond
> > >LAN Technician/Programmer
> > >[EMAIL PROTECTED]
> > >
> > >Please visit http://www.ipswitch.com/support/mailing-lists.html to be
> > >removed from this list.
> >
> >
> >
> > ________________________________
> > You want it? We've got it!
> > http://home.paperwork.com
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
