In an older episode (Sunday 26 June 2005 14:23), Loren Wilton wrote:
> At a guess, these would be rawbody rules on 3.0+. On 2.6x many times you
> can't get to the intervening headers, but if you can, it is usually a 'full'
> rule.
Test result: using debian's SA 3.0.4-2, neither rawbody nor body c
At a guess, these would be rawbody rules on 3.0+. On 2.6x many times you
can't get to the intervening headers, but if you can, it is usually a 'full'
rule.
Since rawbody rules are single line you should be able to safely search for
something like
rawbody FOO/^Note:\swhatever/
Loren
