On Fri, 26 Aug 2016 12:07:48 -0700 (PDT) John Hardin wrote: > On Fri, 26 Aug 2016, Robert Boyl wrote: > > > Rule > > > > describe BRF_TEST123 test > > body BRF_TEST123 \bSe você não deseja mais receber nossos > > e-mails, cancele\b/i > > That's missing a leading slash. Is that a copy+paste error? Do you > run lint checks before restarting SA? That shouldn't have passed lint. > > It should look like: > > body BRF_TEST123 /\bSe você não deseja mais receber nossos > e-mails, cancele\b/i > > > score BRF_TEST123 0.1 > > > > See here the message that qmail cant catch due to a CRLF in middle > > of text (right after word "se") but icewarp can catch even with the > > CR LF. > > > > If I remove the CR LF my qmail catches it (SA). > > That's odd, as SA should normalize that into a single body paragraph > in both cases.
It worked for me with it left in. I don't think we've actually established that it was tested with and without the CR LF with everything else identical. The rule might fail because of the character set. For rules like this to work best the rule file has to be edited as UTF-8 and SA should be configured with normalize_charset 1
