I'm no expert so I may be off-base here, but shouldn't the rule have ()? body RULE_NAME /(bannedc|banned c)/i
I think that without them you're scanning for one of the following strings: "bannedcanned c" or "bannedbanned c". Sandy ----- Original Message ----- From: "John McGivern" <[EMAIL PROTECTED]> To: "Robert Menschel" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Wednesday, August 20, 2003 8:07 AM Subject: RE: [SAtalk] catching the Banned CD spam! > Hey everyone! Thanks for all the responses! I was out of the office yesterday. > > I do have the /i at the end of my rule so it looks like this: > > body RULE_NAME /bannedc|banned c/i > > so that I could catch the case as well. > > I know that phrase is in there obviously but it just won't find it! When I do a commnd line spamassassin -t < message it just doesn't find it. I've done a --lint and there are no qualms there. I've also tested that the rule fires by sending emails with banned c and bannedc in the body and my mail server finds it just fine. > > I think I must be doing something stupid but I just can't figure out what it is! I think I have tested everything. > > I will try some of the variations that you have all suggested and see what spamassassin gives me. > > Thanks! > > John McGivern > > -----Original Message----- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: August 18, 2003 10:09 PM > To: John McGivern > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] catching the Banned CD spam! > > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello John, > > I find the following rules work well for me: > > header RM_sp_BannedCD Subject =~ /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i > describe RM_sp_BannedCD Subject mentions the supposedly banned CD > score RM_sp_BannedCD 1.21 # 21 spam, 0 ham, Aug 12 2003 > > body RM_bp_BannedCD /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i > describe RM_bp_BannedCD Body mentions the supposedly banned CD > score RM_bp_BannedCD 1.21 # 231 spam, 0 ham, Aug 12 2003 > > Bob Menschel > > -----BEGIN PGP SIGNATURE----- > Version: PGP 8.0 > > iQA/AwUBP0GGzZebK8E4qh1HEQKazwCeI8VFy5lB4ZCJk2R2+OJHM/Q75swAoOfi > dJ3dxl42rdxD65ogGnogk+Ib > =resJ > -----END PGP SIGNATURE----- > > > Monday, August 18, 2003, 12:44:24 PM, you wrote: > > JM> Hi everyone, > > JM> I don't know if you guys get the SPAM that advertises the "Banned CD" I get dozens of them. Anyway, I've added a body rule looking for the term "bannedc" or "banned c" and yet it still doesn't > JM> catch it eventhough the text is right there! I know the rule is working because if I email myself something with this phrase, it gets blocked. So, how do they put actual text in an email and it > JM> by SA? The source for the email is below. > > > > > ------------------------------------------------------- > This SF.Net email sponsored by: Free pre-built ASP.NET sites including > Data Reports, E-commerce, Portals, and Forums are available now. > Download today and enter to win an XBOX or Visual Studio .NET. > http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > ------------------------------------------------------- > This SF.net email is sponsored by Dice.com. > Did you know that Dice has over 25,000 tech jobs available today? From > careers in IT to Engineering to Tech Sales, Dice has tech jobs from the > best hiring companies. http://www.dice.com/index.epl?rel_code4 > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code=104 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
