EXIM filter syntax issue

[StoneyCreeker]

I am using the cpanel_exim_system_filter_custom file to filter out hundreds of spams a day and it works great.
I am having trouble with the syntax of this rule and wonder if anyone knows how to fix it? I want to filter out all emails from Vxxx except the ones to certain email addresses.
It is not working

It did work until i added the second email address. I probably have the brackets in the wrong place but i have tried variations without success.

#Vxxx from
if
 $h_from: contains "Vxxx"
and
($h_to: does not contain "[email protected]"
 or
 $h_to: does not contain "[email protected]")
then
 headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif

Thanks

 

[cPanelMichael]

Hello

Have you tried using "and" instead of "or" in the initial part of the filter? EX:

#TestFilterRule
if
 $header_from: contains "Vxxx"
 and $header_from: does not contain "[email protected]"
 and $header_from: does not contain "[email protected]"
then
 headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
 deliver "Global Spam <[email protected]zzz.com>"
 seen finish
endif

Thank you.

 

[StoneyCreeker]

It looks like I tried to make it more complicated than it needed to be. I didn't know you could have multiple "ands" without parentheses.

I changed it yesterday, (putting the "or" first) to:

#Vxxx from
if ($h_to: does not contain "[email protected]" or $h_to: does not contain "[email protected]")
 and
 ($h_from: contains "Vxxxx")
then
 headers add "SpamRule: EXIM FILTER Vxxxx from (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif

I have not received any false positives today, so far, yet, LOL.
If I do and I see it is not working I will try your suggestion.

Thank You Michael!

 

[cPanelMichael]

I am happy to see you were able to resolve the issue. Thank you for updating us with the outcome.

 

[StoneyCreeker]

I still got false positives from my last syntax so today I am trying yours.

Thank You for your suggestion Michael.

 

[StoneyCreeker]

I hope I can ask another very similar question:

My cialis filter rule just caught it's first false positive because the headers contained "specialists".

Here is the rule:

#cialis ANY HEADER
if
  $message_headers: contains "cialis"
then
 headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif

I did a scrabble word search for "cialis" and found two words I would like to exclude from the rule.
"specialist and socialist" that both contain cialis.

My question is:
Can I add the two words with a pipe symbol "|" between them to make an "or" statement like this:

#cialis ANY HEADER
if
  $message_headers: contains "cialis"
	and
	$message_headers: does not contain "specialist|socialist"
then
 headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif

I've seen the piping symbol used in other exim code as an "or" and it would save a lot of time/bytes if I could use it in my filter file that is at 121 KB and 4,098 lines.

I have tried searching the web and I have Phillip Hazel's EXIM book but I can't find a good answer for this question.

My cpanel_exim_system_filter_custom file stops thousands of spams that get by spamassassin every day.

Thank You.

 

[cPanelMichael]

The best way to generate filter rules is to utilize the "Account Level Filters" option in cPanel and then review the actual syntax of the rule in:

/home/$username/etc/filter

You may also want to post to the Exim users mailing list for additional user feedback on your custom filter rules:

Exim Users Mailing List

Thank you.

 

[StoneyCreeker]

After many hours of attempts to block "cialis" and not specialist or socialist unsuccessfully...

The regex I found to work is:

 [^(spe)]cialis\b

After running it through "Account Level Filtering" in CPanel it changed to:

 $header_subject: matches " [^(spe)]cialis\\\\b"

Here is the whole rule. I am using it in my cpanel_exim_system_filter file.
It blocks cialis but lets specialist and socialist through.
I had to add the 3rd line in case cialis was the first word in the subject.
It also will come in handy for other rules.

#cialis subject
if
 $h_subject: matches "[^(spe)]cialis\\\\b"
 or $h_subject: matches "[^(so)]cialis\\\\b"
 or $h_subject: matches "cialis\\\\b"
then
 headers add "SpamRule: EXIM FILTER cialis subject (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif

 

[cPanelMichael]

I am happy to see you were able to find a working filter rule. Thank you for updating us with the outcome.