StoneyCreeker

Well-Known Member
Oct 17, 2006
53
3
158
Upper-East TN
cPanel Access Level
Root Administrator
I am using the cpanel_exim_system_filter_custom file to filter out hundreds of spams a day and it works great.
I am having trouble with the syntax of this rule and wonder if anyone knows how to fix it? I want to filter out all emails from Vxxx except the ones to certain email addresses.
It is not working :(

It did work until i added the second email address. I probably have the brackets in the wrong place but i have tried variations without success.

Code:
#Vxxx from
if
 $h_from: contains "Vxxx"
and
($h_to: does not contain "[email protected]"
 or
 $h_to: does not contain "[email protected]")
then
 headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif
Thanks
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,254
463
Hello :)

Have you tried using "and" instead of "or" in the initial part of the filter? EX:

Code:
#TestFilterRule
if
 $header_from: contains "Vxxx"
 and $header_from: does not contain "[email protected]"
 and $header_from: does not contain "[email protected]"
then
 headers add "SpamRule: EXIM FILTER Vxxx (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif
Thank you.
 

StoneyCreeker

Well-Known Member
Oct 17, 2006
53
3
158
Upper-East TN
cPanel Access Level
Root Administrator
It looks like I tried to make it more complicated than it needed to be. I didn't know you could have multiple "ands" without parentheses. :confused:

I changed it yesterday, (putting the "or" first) to:

Code:
#Vxxx from
if ($h_to: does not contain "[email protected]" or $h_to: does not contain "[email protected]")
 and
 ($h_from: contains "Vxxxx")
then
 headers add "SpamRule: EXIM FILTER Vxxxx from (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif
I have not received any false positives today, so far, yet, LOL.
If I do and I see it is not working I will try your suggestion.

Thank You Michael!
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,254
463
I am happy to see you were able to resolve the issue. Thank you for updating us with the outcome.
 

StoneyCreeker

Well-Known Member
Oct 17, 2006
53
3
158
Upper-East TN
cPanel Access Level
Root Administrator
I hope I can ask another very similar question:

My cialis filter rule just caught it's first false positive because the headers contained "specialists".

Here is the rule:

Code:
#cialis ANY HEADER
if
  $message_headers: contains "cialis"
then
 headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif
I did a scrabble word search for "cialis" and found two words I would like to exclude from the rule.
"specialist and socialist" that both contain cialis.

My question is:
Can I add the two words with a pipe symbol "|" between them to make an "or" statement like this:

Code:
#cialis ANY HEADER
if
  $message_headers: contains "cialis"
	and
	$message_headers: does not contain "specialist|socialist"
then
 headers add "SpamRule: EXIM FILTER cialis ANY HEADERS (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif
I've seen the piping symbol used in other exim code as an "or" and it would save a lot of time/bytes if I could use it in my filter file that is at 121 KB and 4,098 lines.

I have tried searching the web and I have Phillip Hazel's EXIM book but I can't find a good answer for this question.

My cpanel_exim_system_filter_custom file stops thousands of spams that get by spamassassin every day.

Thank You.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,254
463
The best way to generate filter rules is to utilize the "Account Level Filters" option in cPanel and then review the actual syntax of the rule in:

/home/$username/etc/filter

You may also want to post to the Exim users mailing list for additional user feedback on your custom filter rules:

Exim Users Mailing List

Thank you.
 

StoneyCreeker

Well-Known Member
Oct 17, 2006
53
3
158
Upper-East TN
cPanel Access Level
Root Administrator
After many hours of attempts to block "cialis" and not specialist or socialist unsuccessfully...

The regex I found to work is:
Code:
 [^(spe)]cialis\b
After running it through "Account Level Filtering" in CPanel it changed to:

Code:
 $header_subject: matches " [^(spe)]cialis\\\\b"
Here is the whole rule. I am using it in my cpanel_exim_system_filter file.
It blocks cialis but lets specialist and socialist through.
I had to add the 3rd line in case cialis was the first word in the subject.
It also will come in handy for other rules.

Code:
#cialis subject
if
 $h_subject: matches "[^(spe)]cialis\\\\b"
 or $h_subject: matches "[^(so)]cialis\\\\b"
 or $h_subject: matches "cialis\\\\b"
then
 headers add "SpamRule: EXIM FILTER cialis subject (was: $h_subject:)"
 deliver "Global Spam <[email protected]>"
 seen finish
endif
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,254
463
I am happy to see you were able to find a working filter rule. Thank you for updating us with the outcome.