Hey everyone! Thanks for all the responses! I was out of the office yesterday.
I do have the /i at the end of my rule so it looks like this: body RULE_NAME /bannedc|banned c/i so that I could catch the case as well. I know that phrase is in there obviously but it just won't find it! When I do a commnd line spamassassin -t < message it just doesn't find it. I've done a --lint and there are no qualms there. I've also tested that the rule fires by sending emails with banned c and bannedc in the body and my mail server finds it just fine. I think I must be doing something stupid but I just can't figure out what it is! I think I have tested everything. I will try some of the variations that you have all suggested and see what spamassassin gives me. Thanks! John McGivern -----Original Message----- From: Robert Menschel [mailto:[EMAIL PROTECTED] Sent: August 18, 2003 10:09 PM To: John McGivern Cc: [EMAIL PROTECTED] Subject: Re: [SAtalk] catching the Banned CD spam! -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello John, I find the following rules work well for me: header RM_sp_BannedCD Subject =~ /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i describe RM_sp_BannedCD Subject mentions the supposedly banned CD score RM_sp_BannedCD 1.21 # 21 spam, 0 ham, Aug 12 2003 body RM_bp_BannedCD /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i describe RM_bp_BannedCD Body mentions the supposedly banned CD score RM_bp_BannedCD 1.21 # 231 spam, 0 ham, Aug 12 2003 Bob Menschel -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBP0GGzZebK8E4qh1HEQKazwCeI8VFy5lB4ZCJk2R2+OJHM/Q75swAoOfi dJ3dxl42rdxD65ogGnogk+Ib =resJ -----END PGP SIGNATURE----- Monday, August 18, 2003, 12:44:24 PM, you wrote: JM> Hi everyone, JM> I don't know if you guys get the SPAM that advertises the "Banned CD" I get dozens of them. Anyway, I've added a body rule looking for the term "bannedc" or "banned c" and yet it still doesn't JM> catch it eventhough the text is right there! I know the rule is working because if I email myself something with this phrase, it gets blocked. So, how do they put actual text in an email and it JM> by SA? The source for the email is below. ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code4 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
