Two filters being tripped on one message

The "ClamAV working?" thread reminded me of an oddity I've noticed recently...

On Friday, June 18, 2004, at 02:39 PM, Eric Yang wrote:

All of them are order sensitive. When the filter is detected by the ones above, it is intercepted, and the rest of the filters will not have any affect on the mail because the mail is already throw out of the queue.

However, this is what I see occasionally in my logs: ----- 20040617061519-0700:SMTP-Accept:Connect:[216.218.228.13] 20040617061519-0700:LoadHostFilterTable: loading name: Archives - Outbound desc: Sent! 20040617061519-0700:LoadHostFilterTable: loading name: SpamAssassin desc: Yay! 20040617061520-0700:LoadHostFilterTable: loading name: File extensions desc: 20040617061521-0700:LoadHostFilterTable: loading name: Body text desc: bad text 20040617061522-0700:LoadHostFilterTable: loading name: File names desc: 20040617061522-0700:LoadHostFilterTable: loading name: Header From desc: Bad Froms 20040617061523-0700:LoadHostFilterTable: loading name: Header Subject desc: Bad subjects 20040617061523-0700:Hdr Filter Match: Filter Hdr: *Your\sdetails|Re:\sYour\sapplication|Re:\sDetails|Thank\syou!\s|Re:\sWi cked\sscreensaver|Re:\sApproved|Re:\sRe:\sMy\sdetails|Re:\sThank\syou!\s |Re:\sThat\smovie|LiquidGeneration|sex|Stolen\sdocument* 20040617061523-0700:Header Filter: Header Subject Src ip: <bounce-oamvomouogvoui@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> Dst ip: <<snip>> Header: Message-ID: <686661.1087478113327.JavaMail.root@lmdb01> From: Bank Notice <vbktfkfcfatfcz@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> Reply-To: Bank Notice <vbktfkfcfatfcz@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> To: "<snip>" <<snip>> Subject: Your credit report has been processed Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_171115_21903157.1087478113323" X-dc: rgzawrglaavlrlvlrsrnlrew=20svralgagmgvlgms=20snwzlsgzl List-Unsubscribe: <mailto: unsub-vbktfkfcfatfcz@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>

20040617061523-0700:Text Filter Match: Filter Text: spam_assassin 20040617061523-0700:Body Filter Matched 20040617061523-0700:SMTP-Accept:MESSAGE INTERCEPTED and MAILED to: <<snip>>,<<snip>> 20040617061523-0700:Mailbox- Deliver:20040617131523.AAA19180@<snip>@mailer12.yourcardsexpress.com:Bla ck_Hole 20040617061523-0700:Mailbox- Deliver:20040617131523.AAA19180@<snip>@mailer12.yourcardsexpress.com:Spa m 20040617061523-0700:SMTP- Accept:Received:[216.218.228.13]:20040617131523.AAA19180@<snip>@mailer12 .yourcardsexpress.com:5170:0:<bounce- oamvomouogvoui@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>:<<snip>> 20040617061528-0700:SMTP-Accept:Close:[216.218.228.13]:9:0:5052 -----

I have 7 filters set: the first matches src/dst addrs to save a copy of outgoing mail from my domains, followed by spam_assassin, 3 body filters, and 2 header filters. The last 5 filters discard and copy the mail to black_hole, while spam_assassin discards and mails to spam.

Now, the oddities: 1) two filters tripped and both acted on a single message, a header filter and spam_assassin; 2) the header filter that tripped is set to look in Subject:, which you can see shouldn't have tripped it, and I believe it thought it saw "sex" in the "yourcardsexpress.com", even though that's not present in the Subject:, but in the rest of the header.

Other than that, everything is running just fine, and other messages are acted upon correctly. It's not causing me any grief besides feeding duplicate messages to sa-learn (I feed my black_hole catches to spamassassin). I've changed the "sex" to "\ssex" to see if that will fix things. And yes, I always use IE when messing with forms in PO.

Post.Office v3.5.3 release 722 running on OS X Server 10.1.5, PM Dual-G4/1GHz, 1.5GB RAM.

Thanks.

Andy Huang
Director, Technology & Logistics
Team Henderson, Inc.

--------- Tenon Intersystems' Post.Office Mailing List To unsubscribe: send mailto:post_office-request@xxxxxxxxxxxxxxx with the body only containing: unsubscribe Find the searchable mailing list archives at: http://postoffice.computeroil.com/