Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

EXIM filter syntax issue

Discussion in 'E-mail Discussion' started by StoneyCreeker, Feb 24, 2015.

  1. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    1
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I am using the cpanel_exim_system_filter_custom file to filter out hundreds of spams a day and it works great.
    I am having trouble with the syntax of this rule and wonder if anyone knows how to fix it? I want to filter out all emails from Vxxx except the ones to certain email addresses.
    It is not working :(

    It did work until i added the second email address. I probably have the brackets in the wrong place but i have tried variations without success.

    Code:
    #Vxxx from
    if
     $h_from: contains "Vxxx"
    and
    ($h_to: does not contain "sales@xxxx.com"
     or
     $h_to: does not contain "jack@yyyy.com")
    then
     headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    Thanks
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello :)

    Have you tried using "and" instead of "or" in the initial part of the filter? EX:

    Code:
    #TestFilterRule
    if
     $header_from: contains "Vxxx"
     and $header_from: does not contain "sales@xxxx.com"
     and $header_from: does not contain "jack@yyyy.com"
    then
     headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    1
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    It looks like I tried to make it more complicated than it needed to be. I didn't know you could have multiple "ands" without parentheses. :confused:

    I changed it yesterday, (putting the "or" first) to:

    Code:
    #Vxxx from
    if ($h_to: does not contain "sales@xxxx.com" or $h_to: does not contain "jack@yyyy.com")
     and
     ($h_from: contains "Vxxxx")
    then
     headers add "SpamRule: EXIM FILTER Vxxxx from (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    I have not received any false positives today, so far, yet, LOL.
    If I do and I see it is not working I will try your suggestion.

    Thank You Michael!
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    I am happy to see you were able to resolve the issue. Thank you for updating us with the outcome.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    1
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I still got false positives from my last syntax so today I am trying yours.

    Thank You for your suggestion Michael.
     
  6. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    1
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I hope I can ask another very similar question:

    My cialis filter rule just caught it's first false positive because the headers contained "specialists".

    Here is the rule:

    Code:
    #cialis ANY HEADER
    if
      $message_headers: contains "cialis"
    then
     headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    I did a scrabble word search for "cialis" and found two words I would like to exclude from the rule.
    "specialist and socialist" that both contain cialis.

    My question is:
    Can I add the two words with a pipe symbol "|" between them to make an "or" statement like this:

    Code:
    #cialis ANY HEADER
    if
      $message_headers: contains "cialis"
    	and
    	$message_headers: does not contain "specialist|socialist"
    then
     headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
    I've seen the piping symbol used in other exim code as an "or" and it would save a lot of time/bytes if I could use it in my filter file that is at 121 KB and 4,098 lines.

    I have tried searching the web and I have Phillip Hazel's EXIM book but I can't find a good answer for this question.

    My cpanel_exim_system_filter_custom file stops thousands of spams that get by spamassassin every day.

    Thank You.
     
  7. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    The best way to generate filter rules is to utilize the "Account Level Filters" option in cPanel and then review the actual syntax of the rule in:

    /home/$username/etc/filter

    You may also want to post to the Exim users mailing list for additional user feedback on your custom filter rules:

    Exim Users Mailing List

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    1
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    After many hours of attempts to block "cialis" and not specialist or socialist unsuccessfully...

    The regex I found to work is:
    Code:
     [^(spe)]cialis\b 
    After running it through "Account Level Filtering" in CPanel it changed to:

    Code:
     $header_subject: matches " [^(spe)]cialis\\\\b" 
    Here is the whole rule. I am using it in my cpanel_exim_system_filter file.
    It blocks cialis but lets specialist and socialist through.
    I had to add the 3rd line in case cialis was the first word in the subject.
    It also will come in handy for other rules.

    Code:
    #cialis subject
    if
     $h_subject: matches "[^(spe)]cialis\\\\b"
     or $h_subject: matches "[^(so)]cialis\\\\b"
     or $h_subject: matches "cialis\\\\b"
    then
     headers add "SpamRule: EXIM FILTER cialis subject (was: $h_subject:)"
     deliver "Global Spam <globalspam@zzzz.com>"
     seen finish
    endif
     
  9. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    I am happy to see you were able to find a working filter rule. Thank you for updating us with the outcome.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice