Thanks a lot Bill..
i already considered the "multiple" flag and it did not work either... i
mean... the rule works but i only see the first line in Debug mode...
----Pedrod
On Thursday, December 6, 2018, 7:21:46 PM GMT+1, Bill Cole
<[email protected]> wrote:
On 6 Dec 2018, at 12:52, Pedro David Marco wrote:
> Hi,
> i need some wisdom from SA monks please...
> Can anyone explain briefly how header ALL work?
> if i try a rule like this:
> header TESTRULE1 ALL =~ /.+/ism
> Using -D debug mode i only "see" the first header of the email...
> shouldn't i see all headers?
>
> it works nice if i check for something slightly more complex, such
> as....
> header TESTRULE2 ALL =~
> /From=.*pedro.* To=.*pedro.*/ism
> but i am trying to understand how it works... and why i only see one
> line in Debug mode...
> Thx,
> --------PedroD
For a rule to match more than once per message, it needs to have the
'multiple' tflag set, e.g.:
tflags TESTRULE1 multiple maxhits=50
(It's generally wise to set *some* 'maxhits' value on a 'multiple' rule,
since it can save you from runaway scanning of pathological messages.)
--
Bill Cole
[email protected] or [email protected]
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Available For Hire: https://linkedin.com/in/billcole
