The most obvious problem is that you are re-using the rule name. While the configuration is parsed the 2nd line replaces the first then the 3rd line replaces the 2nd line. If you want three rules give them three different names, for example: whitelist_from_luser1 whitelist_from_luser2 whitelist_from_luser3
Alternatively, consider writing a single expression to detect the 3 domains with OR logical conditions. This is left as an exercise for the reader. >>> Bazooka Joe <fastf...@gmail.com> 07/14/09 3:54 PM >>> any idea why this rule never works for domain1 or domain2 but only domain3 header whitelist_from_luser From =~ /domain1\.com/i header whitelist_from_luser From =~ /domain2\.com/i header whitelist_from_luser From =~ /domain3\.com/i score whitelist_from_luser -2.5 How do I log the score for each rule that is triggered? -bazooka
