Re: Help with RegEx Rule

2015-10-09 Thread John Hardin
On Fri, 9 Oct 2015, AK wrote: On 20/09/15 03:07, Dave Funk wrote: Notes: 1) Due to SA pre-processing collapsing body into one long line, cannot match on '^' repeatedly, need to look for '\n' as line break indicator. Find start of a line and then following repeats of ".\n" Dave, I've bee

Re: Help with RegEx Rule

2015-10-09 Thread Bowie Bailey
On 10/9/2015 12:07 AM, AK wrote: On 20/09/15 03:07, Dave Funk wrote: Notes: 1) Due to SA pre-processing collapsing body into one long line, cannot match on '^' repeatedly, need to look for '\n' as line break indicator. Find start of a line and then following repeats of ".\n" Dave, I've be

Re: Help with RegEx Rule

2015-10-08 Thread AK
On 09/10/15 15:10, Kevin A. McGrail wrote: Perhaps you'll have more luck looking at the debug output from SA itself? Something like spamassassin -t -D < email.mbox 2>&1 | grep -i RULE Nope, no luck there either; did not see mention of my rule (though it's located inside /etc/spamassassin/

Re: Help with RegEx Rule

2015-10-08 Thread Kevin A. McGrail
On 10/9/2015 12:07 AM, AK wrote: On 20/09/15 03:07, Dave Funk wrote: Notes: 1) Due to SA pre-processing collapsing body into one long line, cannot match on '^' repeatedly, need to look for '\n' as line break indicator. Find start of a line and then following repeats of ".\n" Dave, I've bee

Re: Help with RegEx Rule

2015-10-08 Thread AK
On 20/09/15 03:07, Dave Funk wrote: Notes: 1) Due to SA pre-processing collapsing body into one long line, cannot match on '^' repeatedly, need to look for '\n' as line break indicator. Find start of a line and then following repeats of ".\n" Dave, I've been creating my own regular expressi

Re: Help with RegEx Rule

2015-10-08 Thread Anthony Kamau
On 20/09/15 03:07, Dave Funk wrote: Notes: 1) Due to SA pre-processing collapsing body into one long line, cannot match on '^' repeatedly, need to look for '\n' as line break indicator. Find start of a line and then following repeats of ".\n" Dave, I need to see the mail message as spamassas

Re: Help with RegEx Rule

2015-09-20 Thread AK
On 20/09/15 03:07, Dave Funk wrote: Final note; now that we've discussed this spam sign, it will probably become useless as spammers follow this list and mutate their crap accordingly to dodge our rules. ;( Awesome notes, Dave, thanks. The tutorial really helped and it's all been added to

Re: Help with RegEx Rule

2015-09-19 Thread Bill Cole
On 19 Sep 2015, at 10:51, AK wrote: Hi all. I'm getting hit with lots of JUNK mail that has multiple lines with just a '.' on several lines [0]. Most of the JUNK email has at least 5 and at most 10 lines (so far) with just this '.' character somewhere in the middle of the message. I've co

Re: Help with RegEx Rule

2015-09-19 Thread Dave Funk
On Sun, 20 Sep 2015, AK wrote: [..snip..] Still no joy after removal. However, at least the rule now hits if I replace: /(^\.\n){5,}/ with /(^\.\n)*/ But that looks like it might bring about some FPs. Any other suggestions? Do you realize that rule will -always- fire on -any- message? T

Re: Help with RegEx Rule

2015-09-19 Thread Dave Funk
On Sun, 20 Sep 2015, AK wrote: Hi all. I'm getting hit with lots of JUNK mail that has multiple lines with just a '.' on several lines [0]. Most of the JUNK email has at least 5 and at most 10 lines (so far) with just this '.' character somewhere in the middle of the message. I've copied

Re: Help with RegEx Rule

2015-09-19 Thread AK
On 20/09/15 01:30, Benny Pedersen wrote: On September 19, 2015 4:52:30 PM AK wrote: = Start Rule Block = rawbody __MANY_PERIODS_1 ALL =~ /(^\.\n){5,}/ remove ALL =~, my own rawbody rules dont have it Still no joy after removal. However, at least the rule now hits if I replace:

Re: Help with RegEx Rule

2015-09-19 Thread Adam Major
Hello If you using compiled rules you probably should use: sa-compile command and restart (if use :) sa-spamd Best Regards.

Re: Help with RegEx Rule

2015-09-19 Thread Benny Pedersen
On September 19, 2015 4:52:30 PM AK wrote: = Start Rule Block = rawbody __MANY_PERIODS_1 ALL =~ /(^\.\n){5,}/ remove ALL =~, my own rawbody rules dont have it

Re: help with regex

2014-02-26 Thread Amir Caspi
On Feb 26, 2014, at 5:49 PM, Jeff Mincy wrote: > Can't you do something like this using a look ahead regexp? > > (?=[A-Z0-9]{30,})(?:[A-Z]*[0-9]){10,} According to regexpal.com, that matches the OP's example. The lookahead works properly in this case, since trying to use (say) 28 numbers fail

Re: help with regex

2014-02-26 Thread Webmaster
thanks!... that appears to work just fine ... tested on http://regexpal.com I will break that down and try to understand how it works. JC On 2/26/14 2:49 PM, Jeff Mincy wrote: From: "Kevin A. McGrail" Date: Wed, 26 Feb 2014 19:06:34 -0500 On 2/26/2014 6:53 PM, Webmaster wrot

Re: help with regex

2014-02-26 Thread Jeff Mincy
From: "Kevin A. McGrail" Date: Wed, 26 Feb 2014 19:06:34 -0500 On 2/26/2014 6:53 PM, Webmaster wrote: > I need a regex to match an alphanumeric string with letters and numbers. > > example: 48HQZBF404TY2298D1414BB8050022YQ3872444 > > The pattern is defined as: >

Re: help with regex

2014-02-26 Thread Kevin A. McGrail
On 2/26/2014 6:53 PM, Webmaster wrote: I need a regex to match an alphanumeric string with letters and numbers. example: 48HQZBF404TY2298D1414BB8050022YQ3872444 The pattern is defined as: A sequence of alphanumeric characters, letters are upper or lower case, at least 30 chars long, containi