EXIM filter syntax issue

I am using the cpanel_exim_system_filter_custom file to filter out hundreds of spams a day and it works great.
I am having trouble with the syntax of this rule and wonder if anyone knows how to fix it? I want to filter out all emails from Vxxx except the ones to certain email addresses.
It is not working

It did work until i added the second email address. I probably have the brackets in the wrong place but i have tried variations without success.

Code:

#Vxxx from
if
 $h_from: contains "Vxxx"
and
($h_to: does not contain "sales@xxxx.com"
 or
 $h_to: does not contain "jack@yyyy.com")
then
 headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
 deliver "Global Spam <globalspam@zzzz.com>"
 seen finish
endif

Thanks

 

It looks like I tried to make it more complicated than it needed to be. I didn't know you could have multiple "ands" without parentheses.

I changed it yesterday, (putting the "or" first) to:

Code:

#Vxxx from
if ($h_to: does not contain "sales@xxxx.com" or $h_to: does not contain "jack@yyyy.com")
 and
 ($h_from: contains "Vxxxx")
then
 headers add "SpamRule: EXIM FILTER Vxxxx from (was: $h_subject:)"
 deliver "Global Spam <globalspam@zzzz.com>"
 seen finish
endif

I have not received any false positives today, so far, yet, LOL.
If I do and I see it is not working I will try your suggestion.

Thank You Michael!

 

I still got false positives from my last syntax so today I am trying yours.

Thank You for your suggestion Michael.

 

I hope I can ask another very similar question:

My cialis filter rule just caught it's first false positive because the headers contained "specialists".

Here is the rule:

Code:

#cialis ANY HEADER
if
  $message_headers: contains "cialis"
then
 headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
 deliver "Global Spam <globalspam@zzzz.com>"
 seen finish
endif

I did a scrabble word search for "cialis" and found two words I would like to exclude from the rule.
"specialist and socialist" that both contain cialis.

My question is:
Can I add the two words with a pipe symbol "|" between them to make an "or" statement like this:

Code:

#cialis ANY HEADER
if
  $message_headers: contains "cialis"
	and
	$message_headers: does not contain "specialist|socialist"
then
 headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
 deliver "Global Spam <globalspam@zzzz.com>"
 seen finish
endif

I've seen the piping symbol used in other exim code as an "or" and it would save a lot of time/bytes if I could use it in my filter file that is at 121 KB and 4,098 lines.

I have tried searching the web and I have Phillip Hazel's EXIM book but I can't find a good answer for this question.

My cpanel_exim_system_filter_custom file stops thousands of spams that get by spamassassin every day.

Thank You.

 

After many hours of attempts to block "cialis" and not specialist or socialist unsuccessfully...

The regex I found to work is:

Code:

 [^(spe)]cialis\b 

After running it through "Account Level Filtering" in CPanel it changed to:

Code:

 $header_subject: matches " [^(spe)]cialis\\\\b" 

Here is the whole rule. I am using it in my cpanel_exim_system_filter file.
It blocks cialis but lets specialist and socialist through.
I had to add the 3rd line in case cialis was the first word in the subject.
It also will come in handy for other rules.

Code:

#cialis subject
if
 $h_subject: matches "[^(spe)]cialis\\\\b"
 or $h_subject: matches "[^(so)]cialis\\\\b"
 or $h_subject: matches "cialis\\\\b"
then
 headers add "SpamRule: EXIM FILTER cialis subject (was: $h_subject:)"
 deliver "Global Spam <globalspam@zzzz.com>"
 seen finish
endif