On Tue, 2008-10-21 at 20:01 +0200, mouss wrote: > Why do you guys put a '.*' there? This would also match > Fair cop, guv, on both counts.
I spotted that '[.*]' didn't do what the OP wanted and didn't look any further. Obviously, ^X-Spam-Status:[ \t]{1,40}(Yes|YES) is better than my original suggestion since it allows only whitespace between the header name and the Yes/No indication. I tested this one in grep with the -P flag on (use a Perl regex). It does what the OP wanted. > Note that it is easier to use X-Spam-Flag if it is available. otherwise, > I should have mentioned that, since I use it in a program that throws spam in the bit bucket. I forgot that X-Spam-Flag exists since it doesn't appear in messages SA thinks are non-spam, which is all that gets into my mailbox. > > X-Spam-Status: No, score=1.9 required=6.0 > This also shows that line wrapping in an incoming X-Spam-Status line may cause match failures unless you're sure that something has unpacked the entire header into a single string before you apply the regex to it. Martin