The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

EXIM filter syntax issue

Discussion in 'E-mail Discussions' started by StoneyCreeker, Feb 24, 2015.

  1. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    50
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I am using the cpanel_exim_system_filter_custom file to filter out hundreds of spams a day and it works great.
    I am having trouble with the syntax of this rule and wonder if anyone knows how to fix it? I want to filter out all emails from Vxxx except the ones to certain email addresses.
    It is not working :(

    It did work until i added the second email address. I probably have the brackets in the wrong place but i have tried variations without success.

    Code:
    #Vxxx from
    if
     $h_from: contains "Vxxx"
    and
    ($h_to: does not contain "sales@xxxx.com"
     or
     $h_to: does not contain "jack@yyyy.com")
    then
     headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    Thanks
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Have you tried using "and" instead of "or" in the initial part of the filter? EX:

    Code:
    #TestFilterRule
    if
     $header_from: contains "Vxxx"
     and $header_from: does not contain "sales@xxxx.com"
     and $header_from: does not contain "jack@yyyy.com"
    then
     headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    Thank you.
     
  3. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    50
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    It looks like I tried to make it more complicated than it needed to be. I didn't know you could have multiple "ands" without parentheses. :confused:

    I changed it yesterday, (putting the "or" first) to:

    Code:
    #Vxxx from
    if ($h_to: does not contain "sales@xxxx.com" or $h_to: does not contain "jack@yyyy.com")
     and
     ($h_from: contains "Vxxxx")
    then
     headers add "SpamRule: EXIM FILTER Vxxxx from (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    I have not received any false positives today, so far, yet, LOL.
    If I do and I see it is not working I will try your suggestion.

    Thank You Michael!
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  5. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    50
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I still got false positives from my last syntax so today I am trying yours.

    Thank You for your suggestion Michael.
     
  6. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    50
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I hope I can ask another very similar question:

    My cialis filter rule just caught it's first false positive because the headers contained "specialists".

    Here is the rule:

    Code:
    #cialis ANY HEADER
    if
      $message_headers: contains "cialis"
    then
     headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    I did a scrabble word search for "cialis" and found two words I would like to exclude from the rule.
    "specialist and socialist" that both contain cialis.

    My question is:
    Can I add the two words with a pipe symbol "|" between them to make an "or" statement like this:

    Code:
    #cialis ANY HEADER
    if
      $message_headers: contains "cialis"
    	and
    	$message_headers: does not contain "specialist|socialist"
    then
     headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    I've seen the piping symbol used in other exim code as an "or" and it would save a lot of time/bytes if I could use it in my filter file that is at 121 KB and 4,098 lines.

    I have tried searching the web and I have Phillip Hazel's EXIM book but I can't find a good answer for this question.

    My cpanel_exim_system_filter_custom file stops thousands of spams that get by spamassassin every day.

    Thank You.
     
  7. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    The best way to generate filter rules is to utilize the "Account Level Filters" option in cPanel and then review the actual syntax of the rule in:

    /home/$username/etc/filter

    You may also want to post to the Exim users mailing list for additional user feedback on your custom filter rules:

    Exim Users Mailing List

    Thank you.
     
  8. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    50
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    After many hours of attempts to block "cialis" and not specialist or socialist unsuccessfully...

    The regex I found to work is:
    Code:
     [^(spe)]cialis\b 
    After running it through "Account Level Filtering" in CPanel it changed to:

    Code:
     $header_subject: matches " [^(spe)]cialis\\\\b" 
    Here is the whole rule. I am using it in my cpanel_exim_system_filter file.
    It blocks cialis but lets specialist and socialist through.
    I had to add the 3rd line in case cialis was the first word in the subject.
    It also will come in handy for other rules.

    Code:
    #cialis subject
    if
     $h_subject: matches "[^(spe)]cialis\\\\b"
     or $h_subject: matches "[^(so)]cialis\\\\b"
     or $h_subject: matches "cialis\\\\b"
    then
     headers add "SpamRule: EXIM FILTER cialis subject (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
     
  9. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
Loading...

Share This Page