OT: SA rule to catch multiple subject lines

[Steve Campbell]

On 6/29/2010 9:32 AM, Steven Andrews wrote:
>
> I'm probably doing this the hard way.  I have a client that likes to 
> block by subject lines.  So far, I've been writing a new rule for each 
> subject line they want to block or putting a "|" in the match for 
> multiple subjects.  I found out that there's a limit to how many times 
> you can use that before the rule doesn't fire anymore...probably on 
> the length of the line.
>
> I'd like to find a better way to write the rule, something along the 
> lines:
>
> Header                 junksubject        Subject =~ /junk subject 1/i
>
> Header                 junksubject        Subject =~ /junk subject 2/i
>
> Score                     junksubject        20.0
>
> Describe              junksubject        blocked subject lines
>
> Although writing the rule this way doesn't seem to work...it catches 
> nothing.
>
> Should I be making this more like a meta rule or is there a smarter 
> way to do it?
>
> Thanks for any direction you can provide.
>
> Steve
>

Try something like this:

Header                __ junksubject1        Subject =~ /junk subject 1/i

Header                __ junksubject2        Subject =~ /junk subject 2/i

meta                     junksubject    (__junksubject1 && __junksubject2)
Score                     junksubject        20.0

Describe              junksubject        blocked subject lines

Steve Campbell
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100629/d1e3ee8b/attachment.html