On Dec 11, 2012, at 3:55 PM, dan (ddp) wrote: > On Mon, Dec 10, 2012 at 12:53 PM, Scott <wa6...@gmail.com> wrote: >> I'm having trouble making a rule to eliminate this false positive, rule 1002 >> is kicking in: >> >> sendmail[24167]: qBAHj1gY023631: to=<fatal-err...@example.com>, >> delay=00:00:06, xdelay=00:00:05, mailer=esmtp, pri=120705, >> relay=xyz.example.com. [1.2.3.4], dsn=2.0.0, stat=Sent (Ok: queued as >> 4D47E343E84D) >> >> This e-mail was successful, even though it is sent to a mailbox for errors. >> > > <rule id="100103" level="1"> > <if_sid>1002</if_sid> > <match>fatal-err...@example.com</match> > <description>Not an error</description> > </rule>
I would have tried that, but doesn't that mean I'd have to add in additional rules to catch failed messages?
