"Loren Wilton" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] >> Right? If I test this rule using the Regex Coach tool at >> http://weitz.de/regex-coach/ (I'm on Windows), with the 'm' switch >> enabled, the rule works fine. But when I test it with SpamAssassin, it >> doesn't work and I believe it's due to the carat and >> dollar. >> >> However I want to specifically specify that the word "test" must be at the >> very end of the Subject line - hence, I want to have >> the $ after it. I also want to specify that the X-Return-Path must be there, >> which is why I have the rest of the rule the way it >> is, but that's not the issue. >> >> What am I doing wrong? >> >> (Of course in reality I'm not searching for the above strings, I'm trying to >> catch a particular spam sign, but this is a simple >> example of the method I'm using) > > > Simpler and more efficient technique, and it will handle the headers in any > order, not just specifically one after the other: > > header __TEST_SUBJECT =~ /test\n?$/ > header __X_RETURN X-Return-Path:exists > meta MY_RULE __TEST_SUBJECT && __X_RETURN > > > If you only want to search headers, you can use the pseudo header ALL and > only search the headers, and not the entire body using a > full rule. > > If you really want to match multiple lines in a specific order, you can use > /s and then use \n to match the newlines explicitly. > (There is a way to get /m to work, but I always have to spend half an hour > testing the rule before I figure out the magic trick > again.) > > Loren
Thanks Loren, I'll give /s a whirl instead, maybe I'll have more luck with that. I did specifically need to search for multiple lines in that way, rather than doing a meta rule, because I actually want to use a tagged expression. Sorry I didn't explain that in my first post - but that's why I need it all in a single rule, which spans multiple lines within the message - ie. I want to search for a certain string which appears in more than one place in the message (and I'm stuck with 3.1.8 at the moment so I can't take advantage of the new features of 3.2 yet...) I've spent a lot more than half an hour trying to get /m to work, with no joy! :) Cheers, Jeremy
