I also noted that following the first TESTSFAILED entry, there is a tab character following [SPF.FAIL]. If that tab exists within your filter file, that would be the issue. You should of course check all of the lines and make sure that no stray unintended characters follow.
Matt
Kami Razvan wrote:
Hi;
I have one filter that is killing me and it just does not make sense for it not to work.
Here is an example of a message that should have triggered it but it has not.
======== Log file ======= 12/20/2004 04:52:48 Qa0e1026302703444 NOT bypassing whitelisting of E-mail with weight >=25 (34) and at least 2 recipients (1). 12/20/2004 04:52:49 Qa0e1026302703444 L1 Message OK 12/20/2004 04:52:49 Qa0e1026302703444 Subject: $250 Shopping Gift Card is pending shipping authorization: confirmation needed X3SFG45 12/20/2004 04:52:49 Qa0e1026302703444 From: [EMAIL PROTECTED] To: Joanna@<deleted>.org IP: 207.244.49.16 ID: 133E6507877
12/20/2004 04:52:49 Qa0e1026302703444 Tests failed [weight=34]:
[SPF.FAIL]=WARN [HELOBOGUS]=WARN [IPNOTINMX]=WARN [NOLEGITCONTENT]=WARN
[LONGSUBJ]=WARN [LINK.BODY]=IGNORE [COMBO.LINK]=WARN
[FILTER.SUBJECT.NUMBER]=IGNORE [SPAM.ENVELOPE]=WARN
WEIGHT-REDIRECT-SPAM-S=SUBJECT WEIGHT-REDIRECT-SPAM-R=ROUTETO 12/20/2004 04:52:49 Qa0e1026302703444 Last action = IGNORE.
======================
Here is the filter:
# [Elevate.SPFFAIL]
TESTSFAILED END NOTCONTAINS [SPF.FAIL] TESTSFAILED END NOTCONTAINS [COMBO.LINK]
TESTSFAILED 0 CONTAINS [NOLEGITCONTENT] TESTSFAILED 0 CONTAINS [HEUR TESTSFAILED 0 CONTAINS [REVDNS]
=======================
Based on the log file entries the following tests have failed:
[SPF.FAIL]=WARN [HELOBOGUS]=WARN [IPNOTINMX]=WARN [NOLEGITCONTENT]=WARN [LONGSUBJ]=WARN [LINK.BODY]=IGNORE [COMBO.LINK]=WARN [FILTER.SUBJECT.NUMBER]=IGNORE [SPAM.ENVELOPE]=WARN WEIGHT-REDIRECT-SPAM-S=SUBJECT WEIGHT-REDIRECT-SPAM-R=ROUTETO
Since [SPF.FAIL], [COMBO.LINK], and [NOLEGITCONTENT] have all failed then I expect this filter to trigger.
Any ideas why it is not?
Regards, Kami
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
