I believe your problem is that you named all of the rules the same, so only the last one is used.
You need to give each of these rules a unique name i.e.: M8RAM_FAKE_BOUNCE_1 ... M8RAM_FAKE_BOUNCE_2 ... Along with the matching "score" rules. On Monday 29 March 2004 12:27 pm, Bram Mertens wrote: > Hi > > I have several spam messages that look like bounced messages only I > never sent the message it's bouncing. > > In the body of the message there's a line that looks like: > From: "optometric" <[EMAIL PROTECTED]> > > I'd like to write a rule that looks for this but I can't figure it out. > Here's what the rule should catch: > "From: " NOT followed by "Bram Mertens " or "Mertens Bram " followed by > "<[EMAIL PROTECTED]>" > > Here's what I've got so far: > this rule catches the above: > body M8RAM_FAKE_BOUNCE > /from\:\s\"optometric\"\s<[EMAIL PROTECTED]>/i > > These don't work: > body M8RAM_FAKE_BOUNCE > /From\:\s(?:(?:Bram\sMertens\s)|(?:Mertens\sBram\s))<[EMAIL PROTECTED] >e>/i body M8RAM_FAKE_BOUNCE > /from\:\s(?!(?:Bram\sMertens\s)|(?:Mertens\sBram\s))<[EMAIL PROTECTED] >e>/i body M8RAM_FAKE_BOUNCE > /from\:\s(?<!(?:Bram\sMertens\s)|(?:Mertens\sBram\s))<[EMAIL PROTECTED] >be>/i body M8RAM_FAKE_BOUNCE > /from\:\s(^(?:Bram\sMertens\s)|(?:Mertens\sBram\s))<[EMAIL PROTECTED] >>/i body M8RAM_FAKE_BOUNCE > /from\:\s[^(?:Bram\sMertens\s)|(?:Mertens\sBram\s)]<[EMAIL PROTECTED] >>/i > > this partly works: > body M8RAM_FAKE_BOUNCE > /from\:\s(?!(?:Bram\sMertens\s)|(?:Mertens\sBram\s)<[EMAIL PROTECTED] >>)/i Only this look for "From: " NOT followed by "Bram Mertens > <[EMAIL PROTECTED]>" or "Mertens Bram <[EMAIL PROTECTED]>" > > > Can anybody explain how to achieve this? > > TIA -- Larry G. Starr - [EMAIL PROTECTED] or [EMAIL PROTECTED] Software Engineer: Full Compass Systems LTD. Phone: 608-831-7330 x 1347 FAX: 608-831-6330 =================================================================== There are only three sports: bullfighting, mountaineering and motor racing, all the rest are merely games! - Ernest Hemmingway
