EXIM filter syntax issue

StoneyCreeker

February 24, 2015 10:24

I am using the cpanel_exim_system_filter_custom file to filter out hundreds of spams a day and it works great. I am having trouble with the syntax of this rule and wonder if anyone knows how to fix it? I want to filter out all emails from Vxxx except the ones to certain email addresses. It is not working :( It did work until i added the second email address. I probably have the brackets in the wrong place but i have tried variations without success.

#Vxxx from
if
 $h_from: contains "Vxxx"
and
($h_to: does not contain "sales@xxxx.com"
 or
 $h_to: does not contain "jack@yyyy.com")
then
 headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
 deliver "Global Spam "
 seen finish
endif

Thanks

Comments

8 comments

cPanelMichael

February 25, 2015 14:44
Hello :) Have you tried using "and" instead of "or" in the initial part of the filter? EX:
#TestFilterRule if $header_from: contains "Vxxx" and $header_from: does not contain "sales@xxxx.com" and $header_from: does not contain "jack@yyyy.com" then headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)" deliver "Global Spam " seen finish endif
Thank you.
0
StoneyCreeker

February 25, 2015 15:22
It looks like I tried to make it more complicated than it needed to be. I didn't know you could have multiple "ands" without parentheses. :confused: I changed it yesterday, (putting the "or" first) to:
#Vxxx from if ($h_to: does not contain "sales@xxxx.com" or $h_to: does not contain "jack@yyyy.com") and ($h_from: contains "Vxxxx") then headers add "SpamRule: EXIM FILTER Vxxxx from (was: $h_subject:)" deliver "Global Spam " seen finish endif
I have not received any false positives today, so far, yet, LOL. If I do and I see it is not working I will try your suggestion. Thank You Michael!
0
cPanelMichael

February 25, 2015 16:31
I am happy to see you were able to resolve the issue. Thank you for updating us with the outcome.
0
StoneyCreeker

February 28, 2015 17:46
I still got false positives from my last syntax so today I am trying yours. Thank You for your suggestion Michael.
0
StoneyCreeker

February 28, 2015 18:19
I hope I can ask another very similar question: My cialis filter rule just caught it's first false positive because the headers contained "specialists". Here is the rule:
#cialis ANY HEADER if $message_headers: contains "cialis" then headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)" deliver "Global Spam " seen finish endif
I did a scrabble word search for "cialis" and found two words I would like to exclude from the rule. "specialist and socialist" that both contain cialis. My question is: Can I add the two words with a pipe symbol "|" between them to make an "or" statement like this:
#cialis ANY HEADER if $message_headers: contains "cialis" and $message_headers: does not contain "specialist|socialist" then headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)" deliver "Global Spam " seen finish endif
I've seen the piping symbol used in other exim code as an "or" and it would save a lot of time/bytes if I could use it in my filter file that is at 121 KB and 4,098 lines. I have tried searching the web and I have Phillip Hazel's EXIM book but I can't find a good answer for this question. My cpanel_exim_system_filter_custom file stops thousands of spams that get by spamassassin every day. Thank You.
0
cPanelMichael

March 02, 2015 18:15
The best way to generate filter rules is to utilize the "Account Level Filters" option in cPanel and then review the actual syntax of the rule in: /home/$username/etc/filter You may also want to post to the Exim users mailing list for additional user feedback on your custom filter rules: Exim Users Mailing List Thank you.
0
StoneyCreeker

April 22, 2015 21:45
After many hours of attempts to block "cialis" and not specialist or socialist unsuccessfully... The regex I found to work is:
[^(spe)]cialis\b
After running it through "Account Level Filtering" in CPanel it changed to:
$header_subject: matches " [^(spe)]cialis\\\\b"
Here is the whole rule. I am using it in my cpanel_exim_system_filter file. It blocks cialis but lets specialist and socialist through. I had to add the 3rd line in case cialis was the first word in the subject. It also will come in handy for other rules.
#cialis subject if $h_subject: matches "[^(spe)]cialis\\\\b" or $h_subject: matches "[^(so)]cialis\\\\b" or $h_subject: matches "cialis\\\\b" then headers add "SpamRule: EXIM FILTER cialis subject (was: $h_subject:)" deliver "Global Spam " seen finish endif
0
cPanelMichael

April 24, 2015 04:27
I am happy to see you were able to find a working filter rule. Thank you for updating us with the outcome.
0

Please sign in to leave a comment.

Comments

Didn't find what you were looking for?