Marco, Thanks, but I already know how to write meta rules :) That's not what I'm asking. My example lines are not textual lines, but the form that spam takes. It's not that simple.
Ruben. > -----Mensaje original----- > De: Marco Maske [mailto:[EMAIL PROTECTED] > Enviado el: domingo, 26 de febrero de 2006 12:28 > Para: [email protected] > Asunto: Re: I catch all this spam, but just for curiosity... > > Ruben Cardenal wrote: > > > To: [EMAIL PROTECTED] > > Subject: /^Fw:\s\d{3,6}$/ > > > > In the body of the mail: > > > > /^Subject:\sjohn$/ > > > > How could a rule score catch those 3 things at a time? I know how to > > do it for the headers part (someone in this lists told me how), but I > > don't know how to relate that line of the body with the "To" part of > > the headers. I mean, the "john" word in that line of the body matches > > the "john" word in the "To". I hope I've explained myself enough :) > > If I understand you right, then you want a meta Rule: > First the rules for meta must start with "__": > > header __MY_FIRST_RULE To =~ /[EMAIL PROTECTED]/ > header __MY_SECOND_RULE Subject =~ /^Fw:\s\d{3,6}$/ > body __MY_THIRD_RULE /^Subject:\sjohn$/ > > # Then the meta is easy. The rules can be: AND "&&", OR "||" > # NAND, NOR (negotation) is set so: !__MY_FIRST_RULE > > meta EXAMPLE_RULE ( __MY_FIRST_RULE && __MY_SECOND_RULE && > __MY_THIRD_RULE) > > describe EXAMPLE_RULE How to write a meta rule > score EXAMPLE_RULE 5 > > -- > Ciao Marco, registered GNU/Linux-User 313353
