2012/5/18 Richard Jones <[email protected]>: > On Thu, May 17, 2012 at 05:00:51PM +0300, Risto Vaarandi wrote: >> hi Richard, is my understanding correct that the first two log >> messages are coming from one server, and are thus always appearing in >> this order? If the third message is the one that might appear before >> (or in between) of them, then you could try EventGroup rule for which >> is designed for matching events coming in any order. Below, I have >> slightly modified your ruleset: > > Actually I did mean that the events could come in any order. However, > looking at the real world logs files, you're correct, the smtp logs are > always in order. > > Thanks very much for your help. I can now get on with spam-spotting and > elimination. > > I have plenty of other questions, but documentation is a little scarce > for this project. Is there anywhere I can get a hold of archives of this > mailing list? There's a search function on sourceforge, but nothing > beats regexps on your local mail spool! >
Well, unfortunately it seems that SourceForge doesn't have the archive available as a text file :( Are you looking for something fairly specific? kind regards, risto > Thanks again, > > Richard > > -- > Richard Jones +44 7843 588 599 > "Quod gratis asseritur, gratis negatur" > Privacy notice: http://www.jonze.com/privacy.html ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
