We have a simple restriction class to which we apply SAV and RAV to a very small class of msgs:
some_class = check_helo_access pcre:/path/to/4tuple_unfiltered.pcre, reject_unverified_sender, reject_unverified_recipient, check_helo_access pcre:/path/to/4tuple_filtered.pcre, permit The 4tuple filters match all HELO with "/.*/ WARN", so we get all 4 envelope fields on one line. (trick learned on this list) the mystery is that even when RAV or SAV rejects, we still get the "filtered" log line. Len