Bonno, you can do this, but probably not in a single filter file.
A couple of key points for advanced filter file usage:
You can define weights per tests in a filter file, and you can assign
weight to a whole filter file, and these weights are cumulative.
You can trigger a filter file even when the weight assigned to the tests
is zero, and then use the TestsFailed test to determine whether the
whole filter file was triggered.
Inside of a single filter file you can have many tests with a single
point, and then use the MinWeightToFail and MaxWeight predicates to
control the weight assigned in a filter file.
For filter files, the order they appear in your global.cfg is also their
order of execution, so you can effectively construct AND statements by
having files called test1, then test2 and then a result file that uses
TestsFailed to determine if the other tests were triggered.
So...
FILTER-VFRIEND-SUBJECT
which only tests for a subject, and sets the weight to 0, e.g.
SUBJECT 0 IS zoek een vaste vriend
FILTER-VFRIEND-LINK
which only tests for a variety of of links, e.g.
BODY 0 CONTAINS http://geocities.com/
FILTER-VFRIEND-TEXT
which only tests for a variety of text
BODY 0 CONTAINS Ik zoek een vriend
BODY 0 CONTAINS seks-partner
and then last, your "result" that actually assigns weight:
FILTER-VFRIEND-SEKS-BOMB
TESTSFAILED END NOTCONTAINS FILTER-VFRIEND-SUBJECT
TESTSFAILED END NOTCONTAINS FILTER-VFRIEND-LINK
TESTSFAILED 15 CONTAINS FILTER-VFRIEND-TEXT
If the filter files contain lots of triggers, some of which are bad and
you want to award points anyway, you can use the MinWeightToFail and
MaxWeight to control the minimum hits and the maximum weight in a given
filter file.
If you want to save every last bit of processing time, when you have
multiple tests, you can use the TESTSFAILED END NOTCONTAINS at the top
of each subsequent one so that processing is skipped. In the example
above, you would have FILTER-VFRIEND-SUBJECT always run, but
FILTER-VFRIEND-LINK would end if FILTER-VFRIEND-SUBJECT hadn't triggered
(failed), and FILTER-VFRIEND-TEXT would end if FILTER-VFRIEND-LINK
hadn't triggered (failed), and then FILTER-VFRIEND-SEKS-BOMB would only
have to test whether FILTER-VFRIEND-TEXT was triggered.
Andrew 8)
________________________________
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Bonno Bloksma
Sent: Monday, November 26, 2007 7:03 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] filters
Hi,
Every example I see at the Declude site for lines in a filter
files seems to indicate that I HAVE to have a weight listed or some
other action.
What if I want to create a filter file that identifies the
specific mails and then assign a weight in de global file?
For instance, we not get some spam with a specific subject, a
specific line of text in each mail and a link to geocities.
I want mail that has all characteristics to get a certaing
weight.
Global.cfg
FILTER-VRIEND filter C:\IMail\Declude\Filters\Vriend.txt x 0 0
Vriend.txt
SUBJECT 10 IS zoek een vaste vriend
BODY 2 CONTAINS http://geocities.com/
BODY 5 CONTAINS http://geocities.com/KatieDavenport89
BODY 5 CONTAINS http://geocities.com/ElbertMacias
BODY 5 CONTAINS http://geocities.com/ZachariahBuck33
BODY 5 CONTAINS http://geocities.com/JanHammond97
BODY 5 CONTAINS http://geocities.com/GenaroRogers
BODY 5 CONTAINS Ik zoek een vriend / seks-partner
But this is not quite what I want. I want to assign 15 points if
the subject is correct, if the specific line of text is there and if
there is a geocities link.
And then I could add some weight is a specific geocities link is
present.
So... how do I do that?
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hotelmanagement en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> / www.tio.nl
<http://www.tio.nl>
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
