Christopher Eykamp said:

> At 09:58 AM 6/16/2003 -0400, Chris Santerre wrote:
> >This isn't a request, more an open discussion.
> >
> >Would it be good to program a default counter function in SA so that users 
> >may custom write rules using it. IE a simple function call in SA called 
> >'counter' instead of header. Then you simply feed it a regex and give it a 
> >minimum.
> >
> >counter MY_TEST <br> ,5
> >
> >this would mean if the term <br> is found in the rawbody at least 5 times, 
> >then it is a hit.
> >(OH, and I have no clue how to program this!)
> >
> >Thoughts?
> You could write a similar rule like this:
> rawbody MY_TEST /<br>.*<br>.*<br>.*<br>.*<br>/is

this is somethign to watch out for -- .* will cause massive slowdowns
on large messages.  Better to do

  rawbody MY_TEST /<br>.{0,40}<br>.{0,40}<br>.{0,40}<br>.{0,40}<br>/is

it'd still be slow though ;)

This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
Spamassassin-talk mailing list

Reply via email to