On Tue, 2009-07-14 at 12:54 -0700, Bazooka Joe wrote: > any idea why this rule never works for domain1 or domain2 but only domain3 > > header whitelist_from_luser From =~ /domain1\.com/i > header whitelist_from_luser From =~ /domain2\.com/i > header whitelist_from_luser From =~ /domain3\.com/i
Because you redefined whitelist_from_luser twice? > score whitelist_from_luser -2.5 > > > How do I log the score for each rule that is triggered? header WHITELIST_FROM_LUSER1 From =~ /domain1\.com/i header WHITELIST_FROM_LUSER2 From =~ /domain2\.com/i header WHITELIST_FROM_LUSER3 From =~ /domain3\.com/i score WHITELIST_FROM_LUSER1 -2.5 score WHITELIST_FROM_LUSER2 -2.5 score WHITELIST_FROM_LUSER3 -2.5 -- Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX www.austinenergy.com
signature.asc
Description: This is a digitally signed message part
