RE: [Declude.JunkMail] PCRE tests
Hi David - Thanks for the tips - very good information for this beginner. I changed the "e-card" one below to only look at the subject, as that is the one that I have seen. However, I had another one for some stocks that I had set up the same, and since I do want it to look "anywhere" I used your suggestion. I did try (\bERMX\b) the other day, but didn't have it combined with the ?i:, so it wasn't working. I will give this a shot. Thanks! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, July 09, 2007 7:47 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Hi Todd, A couple of suggestions (?i:receive.*(postcard|greeting|ecard|e-card)) could also be written as: (?i:receive.{0,50}(postcard|greeting|e.?card)) As you are checking anywhere you want to limit the amount of characters between receive and the postcard etc. if you were using SUBJECT the .* would be fine. Also the ecard|e-card is better written as e.?card that is e.(anychar)?{0,1}card Secondly (?i:ERMX) will produce false positives because of BASE64 encoding which uses strings of "random" characters, it would be better to use the word break which is \b so you could do it like (?i:\bERMX\b) David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 12:15 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests UGGH, it always takes sending something to a LOT of people for you to see how dumb you are... I thought I had the postcard test (which is what I had been troubleshooting) set up for "ANYWHERE", but it's just looking in the body and probably not finding a match. It's been more common on the Subject. Let me change that and report back! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 10:59 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Hi David - Yes, I just confirmed that I have 4.3.46. Below are two that I just put in. By the way, I warn at 15, fail at 20, and delete at 45. Thanks! Todd # for the postcard greetings that are going through (aka "You've received a postcard from a Partner!") BODY10 PCRE (?i:receive.*(postcard|greeting|ecard|e-card)) # for the stock spam coming through for ERMX (aka "Stock Watch ERMX") BODY20 PCRE(?i:ERMX) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, July 06, 2007 10:18 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Todd, Ensure you have version 4.3.46 of Declude. The format of an expression is: LOCATIONWEIGHT PCRE(EXPRESSION) Eg. BODY5 PCRE(?i:Hello World) Post some examples that you are using but not getting hits. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 11:08 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] PCRE tests Is there anything special that I need to have "turned on" to take advantage of this? I've been playing around with it, and really like what it can do. Being a complete newbie to regex, I've been using Regex Buddy to test the expressions before putting them into "production". However, I'm not seeing any hits in the emails. I have not turned on logging (sorry!) but was wondering if I need to add any additional information to the config files for this to be noticed, or if it is by default. I am running the latest version. Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail&
RE: [Declude.JunkMail] PCRE tests
Hi Todd, A couple of suggestions (?i:receive.*(postcard|greeting|ecard|e-card)) could also be written as: (?i:receive.{0,50}(postcard|greeting|e.?card)) As you are checking anywhere you want to limit the amount of characters between receive and the postcard etc. if you were using SUBJECT the .* would be fine. Also the ecard|e-card is better written as e.?card that is e.(anychar)?{0,1}card Secondly (?i:ERMX) will produce false positives because of BASE64 encoding which uses strings of "random" characters, it would be better to use the word break which is \b so you could do it like (?i:\bERMX\b) David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 12:15 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests UGGH, it always takes sending something to a LOT of people for you to see how dumb you are... I thought I had the postcard test (which is what I had been troubleshooting) set up for "ANYWHERE", but it's just looking in the body and probably not finding a match. It's been more common on the Subject. Let me change that and report back! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 10:59 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Hi David - Yes, I just confirmed that I have 4.3.46. Below are two that I just put in. By the way, I warn at 15, fail at 20, and delete at 45. Thanks! Todd # for the postcard greetings that are going through (aka "You've received a postcard from a Partner!") BODY10 PCRE (?i:receive.*(postcard|greeting|ecard|e-card)) # for the stock spam coming through for ERMX (aka "Stock Watch ERMX") BODY20 PCRE(?i:ERMX) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, July 06, 2007 10:18 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Todd, Ensure you have version 4.3.46 of Declude. The format of an expression is: LOCATIONWEIGHT PCRE(EXPRESSION) Eg. BODY5 PCRE(?i:Hello World) Post some examples that you are using but not getting hits. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 11:08 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] PCRE tests Is there anything special that I need to have "turned on" to take advantage of this? I've been playing around with it, and really like what it can do. Being a complete newbie to regex, I've been using Regex Buddy to test the expressions before putting them into "production". However, I'm not seeing any hits in the emails. I have not turned on logging (sorry!) but was wondering if I need to add any additional information to the config files for this to be noticed, or if it is by default. I am running the latest version. Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] PCRE tests
OK, it's working. Sorry for the false alarm! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 11:15 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests UGGH, it always takes sending something to a LOT of people for you to see how dumb you are... I thought I had the postcard test (which is what I had been troubleshooting) set up for "ANYWHERE", but it's just looking in the body and probably not finding a match. It's been more common on the Subject. Let me change that and report back! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] PCRE tests
UGGH, it always takes sending something to a LOT of people for you to see how dumb you are... I thought I had the postcard test (which is what I had been troubleshooting) set up for "ANYWHERE", but it's just looking in the body and probably not finding a match. It's been more common on the Subject. Let me change that and report back! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 10:59 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Hi David - Yes, I just confirmed that I have 4.3.46. Below are two that I just put in. By the way, I warn at 15, fail at 20, and delete at 45. Thanks! Todd # for the postcard greetings that are going through (aka "You've received a postcard from a Partner!") BODY10 PCRE (?i:receive.*(postcard|greeting|ecard|e-card)) # for the stock spam coming through for ERMX (aka "Stock Watch ERMX") BODY20 PCRE(?i:ERMX) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, July 06, 2007 10:18 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Todd, Ensure you have version 4.3.46 of Declude. The format of an expression is: LOCATIONWEIGHT PCRE(EXPRESSION) Eg. BODY5 PCRE(?i:Hello World) Post some examples that you are using but not getting hits. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 11:08 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] PCRE tests Is there anything special that I need to have "turned on" to take advantage of this? I've been playing around with it, and really like what it can do. Being a complete newbie to regex, I've been using Regex Buddy to test the expressions before putting them into "production". However, I'm not seeing any hits in the emails. I have not turned on logging (sorry!) but was wondering if I need to add any additional information to the config files for this to be noticed, or if it is by default. I am running the latest version. Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] PCRE tests
Yeah, just checked - it's there. :) Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, July 06, 2007 10:53 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Also make sure there is the pcre3.dll in your imail folder. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, July 06, 2007 10:18 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Todd, Ensure you have version 4.3.46 of Declude. The format of an expression is: LOCATIONWEIGHT PCRE(EXPRESSION) Eg. BODY5 PCRE(?i:Hello World) Post some examples that you are using but not getting hits. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 11:08 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] PCRE tests Is there anything special that I need to have "turned on" to take advantage of this? I've been playing around with it, and really like what it can do. Being a complete newbie to regex, I've been using Regex Buddy to test the expressions before putting them into "production". However, I'm not seeing any hits in the emails. I have not turned on logging (sorry!) but was wondering if I need to add any additional information to the config files for this to be noticed, or if it is by default. I am running the latest version. Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] PCRE tests
Hi David - Yes, I just confirmed that I have 4.3.46. Below are two that I just put in. By the way, I warn at 15, fail at 20, and delete at 45. Thanks! Todd # for the postcard greetings that are going through (aka "You've received a postcard from a Partner!") BODY10 PCRE (?i:receive.*(postcard|greeting|ecard|e-card)) # for the stock spam coming through for ERMX (aka "Stock Watch ERMX") BODY20 PCRE(?i:ERMX) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, July 06, 2007 10:18 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Todd, Ensure you have version 4.3.46 of Declude. The format of an expression is: LOCATIONWEIGHT PCRE(EXPRESSION) Eg. BODY5 PCRE(?i:Hello World) Post some examples that you are using but not getting hits. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 11:08 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] PCRE tests Is there anything special that I need to have "turned on" to take advantage of this? I've been playing around with it, and really like what it can do. Being a complete newbie to regex, I've been using Regex Buddy to test the expressions before putting them into "production". However, I'm not seeing any hits in the emails. I have not turned on logging (sorry!) but was wondering if I need to add any additional information to the config files for this to be noticed, or if it is by default. I am running the latest version. Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] PCRE tests
Also make sure there is the pcre3.dll in your imail folder. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, July 06, 2007 10:18 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] PCRE tests Todd, Ensure you have version 4.3.46 of Declude. The format of an expression is: LOCATIONWEIGHT PCRE(EXPRESSION) Eg. BODY5 PCRE(?i:Hello World) Post some examples that you are using but not getting hits. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 11:08 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] PCRE tests Is there anything special that I need to have "turned on" to take advantage of this? I've been playing around with it, and really like what it can do. Being a complete newbie to regex, I've been using Regex Buddy to test the expressions before putting them into "production". However, I'm not seeing any hits in the emails. I have not turned on logging (sorry!) but was wondering if I need to add any additional information to the config files for this to be noticed, or if it is by default. I am running the latest version. Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] PCRE tests
Todd, Ensure you have version 4.3.46 of Declude. The format of an expression is: LOCATIONWEIGHT PCRE(EXPRESSION) Eg. BODY5 PCRE(?i:Hello World) Post some examples that you are using but not getting hits. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, July 06, 2007 11:08 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] PCRE tests Is there anything special that I need to have "turned on" to take advantage of this? I've been playing around with it, and really like what it can do. Being a complete newbie to regex, I've been using Regex Buddy to test the expressions before putting them into "production". However, I'm not seeing any hits in the emails. I have not turned on logging (sorry!) but was wondering if I need to add any additional information to the config files for this to be noticed, or if it is by default. I am running the latest version. Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] PCRE tests
Is there anything special that I need to have "turned on" to take advantage of this? I've been playing around with it, and really like what it can do. Being a complete newbie to regex, I've been using Regex Buddy to test the expressions before putting them into "production". However, I'm not seeing any hits in the emails. I have not turned on logging (sorry!) but was wondering if I need to add any additional information to the config files for this to be noticed, or if it is by default. I am running the latest version. Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.