On Mon, 7 Feb 2005, Alex Broens wrote: > [EMAIL PROTECTED] wrote: > > On Mon, 7 Feb 2005 [EMAIL PROTECTED] wrote: > > > >>I just created a rule for the most common spams that have been making it > >>through SA, but for some reason, it's not showing up in the tests: > >> > >>body SEE_ATTACH /See attachment message.html/i > >>describe SEE_ATTACH body contains See attachment message.html > >>score SEE_ATTACH 5.0 > >> > >>--lint shows no problems.... > > > > > > (replying to my own post) > > I found out what the problem is, and it seems like it should be considered > > a bug in SA. The text in question is in the second line of the body of > > the message, and it seems it is being ignored by SA, because if I insert a > > couple of LFs to move it down, the rule kicks in. I had tried changing it > > from "body" to "header" (also tried "rawbody) and that didn't work. Here > > is a look at the offending message, sans the html attachment: > > > have you tried escaping the period? > > body SEE_ATTACH /See attachment message\.html/i
Yes, I did...that didn't fix the problem....only inserting the LFs worked. It was like SA did not recognize the first two lines of the body at all. James Smallacombe PlantageNet, Inc. CEO and Janitor [EMAIL PROTECTED] http://3.am =========================================================================
