regular expression needed

Usually we receive spam having subjects like these examples in order of time : Subject FromTo FedEx Shipment 702193383647 Notification

Re: spamassassin -D --lint

On 28 Sep 2016, at 1:58, Luciano Rinetti wrote: When i run the "spamassassin -D --lint" i get the message: Sep 28 07:45:57.329 [13116] dbg: config: warning: score set for non-existent rule "rulenames" where rulenames are: RCVD_IN_MSPIKE_H4 RCVD_IN_MSPIKE_WL FREEMAIL_FORGED_FROMDOMAIN RCVD_IN_M

Re: regular expression needed

On 9/28/2016 9:02 AM, Nicola Piazzi wrote: Usually we receive spam having subjects like these examples in order of time : Subject FromTo FedEx Shipment 702193383647 Notification j...@company1.com s...@mycompany.it FedEx S

R: regular expression needed

Bowie, your ia a manual way, it works but is not automated Automation is a plugin that check similar words in oldest messages (for example 3 of 4 words match) Then plugin check if sender domain is different and recipient is different Da: Bowie Bailey [mailto:bowie_bai...@buc.com] Inviato: merc

Re: R: regular expression needed

I'm still not clear on exactly what you are trying to do, but in order to test anything against previous messages, you will need a custom SA plugin and some sort of database to store the information about previous emails. That is beyond my area of expertise. If you just need a regex to match

Re: NOTSAME__REPLY_TO

On 09/28/2016 04:21 PM, SA wrote: I'm getting false positives on this one... NOTSAME__REPLY_TO From yahoo but reply to yandex score 1.0 ... where reply-to and from are both yahoo.co.uk. There is no sign of yandex anywhere. I've looked for this rule but cannot find it. Could someone please a)

Re: spamassassin -D --lint

I've tried to run "spamassassin -D --lint" several times over the past few years but never successfully. It always over-spills Terminal and all attempts to pipe it to file or to more / less fail. Is there ANY way to get a sensible listing from this command, please? I'm sure there must be. -- D

NOTSAME__REPLY_TO

I'm getting false positives on this one... NOTSAME__REPLY_TO From yahoo but reply to yandex score 1.0 ... where reply-to and from are both yahoo.co.uk. There is no sign of yandex anywhere. I've looked for this rule but cannot find it. Could someone please a) tell me where it is and b) fix

Re: spamassassin -D --lint

On 9/28/2016 10:26 AM, SA wrote: I've tried to run "spamassassin -D --lint" several times over the past few years but never successfully. It always over-spills Terminal and all attempts to pipe it to file or to more / less fail. Is there ANY way to get a sensible listing from this command, plea

Re: spamassassin -D --lint

On 09/28/2016 04:26 PM, SA wrote: I've tried to run "spamassassin -D --lint" several times over the past few years but never successfully. It always over-spills Terminal and all attempts to pipe it to file or to more / less fail. Is there ANY way to get a sensible listing from this command, pleas

Re: spamassassin -D --lint

On 28/09/16 15:31, Axb wrote: You are awake that it's not really polite to hijack a thread with something totally unrelated? It was relevant. I was trying to compare my system to the OP's. -- Dave Stiles

Re: spamassassin -D --lint

Many thanks for that, Bowie. -- Dave Stiles

Re: NOTSAME__REPLY_TO

> what .cf file includes that rule on your system? That was the point: I can't find it. I've done a grep for NOTSAME on usr/share/spamassassin/*.cf but got nothing. Is there another place I should be looking? Forgot to mention: SA version: 3.3.2 Perl version: 5.14.2 -- Dave Stiles

Re: R: regular expression needed

On Wed, 2016-09-28 at 13:29 +, Nicola Piazzi wrote: > a plugin that check similar words in oldest messages (for example 3 of > 4 words match) > > Then plugin check if sender domain is different and recipient is > different > Detection routine > > > >

Re: NOTSAME__REPLY_TO

Le 28/09/2016 à 16:56, SA a écrit : what .cf file includes that rule on your system? That was the point: I can't find it. I've done a grep for NOTSAME on usr/share/spamassassin/*.cf but got nothing. Is there another place I should be looking? /etc/mail/spamassassin is another likely place, bu

Re: R: R: regular expression needed

Please keep list emails on the list. I don't think you could do a simple regex match for what you want. As I said previously, this would require a plugin both to build the custom regex(s) (or DB query) and to search for the previous emails. You would want to keep the prior email information i

R: R: R: regular expression needed

Obviously i intended to write a plugin that search the db But I need the regex syntax to search at least 3 words that match of 4 words given Nicola Piazzi CED - Sistemi COMET s.p.a. Via Michelino, 105 - 40127 Bologna - Italia Tel. +39 051.6079.293 Cell. +39 328.21.73.470 Web: www.gruppocomet.it

Re: R: R: R: regular expression needed

I don't know of a way to do that with a simple regex. But since you are writing a plugin, you could do it by parsing the output of a regex search. 1) Create a regex which will match on any combination of 3 of the words. This will let you pull all of the possible matches from previous emails.

Re: NOTSAME__REPLY_TO

> If you still can't find it, try doing > spamassassin --lint -Dconfig Ok, John, that pointed me in the right direction. Thanks. It was in whitelist_dkim.cf of all places! I can't recall specifically adding that rule to the whitelist but then: I have a poor memory for such things; but the

R: R: R: R: regular expression needed

This is what i need Bowie The query must be select from_address, from_domain, to_address, subject from maillog where subject REGEXP '\b(?:(?:FedEx|Shipment|702193383246|Notification)\b.*?){3}'; But unfortunately mysql give error ERROR 1139 (42000): Got error 'repetition-operator operand invalid'

Re: regular expression needed

I am not familiar with MySQL regular expressions. The regex I provided uses Perl syntax. It doesn't use lookarounds. I can think of two things offhand that might be an issue. 1) Maybe it doesn't like the non-capturing groups. (?: ) Try it without the "?:" on the two groups: \b((FedEx|S

Re: R: R: regular expression needed

On Wed, 28 Sep 2016, Bowie Bailey wrote: I don't think you could do a simple regex match for what you want. As I said previously, this would require a plugin both to build the custom regex(s) (or DB query) and to search for the previous emails. You would want to keep the prior email informati

Re: R: R: R: regular expression needed

On 28 Sep 2016, at 11:20, Nicola Piazzi wrote: But I need the regex syntax to search at least 3 words that match of 4 words given This can be done with a SA meta rule: header __FOO_IN_SUBJ Subject =~ /foo/i header __BAR_IN_SUBJ Subject =~ /bar/i header __BAZ_IN_SUBJ Subject =~ /baz/i header _