The problem was multiline rules with rawbody. Changing it to full and things work. (I missed that little detail in the wiki, and there are body rules in the dist that have /is)
<Request> A rule in-between rawbody/full? I.e. the whole body, but not the headers? Or even better, in addition to that, plain/html/etc.. scanning only the "plain" or "html" part of the body. </Request> Hell, I'll try to write it if anyone can give me some pointers... e.g. * Can you add new "targets (header/body/etc)" from a plugin. * Where in the code do I look for the "message and all its parts" that is in memory. I know I'm being lazy, read the code. But hints would be greatly appreciated. michael...
