RE: [vps-mail] Procmail rule help

["Andy McKell, FOCUS Internet" <mac@xxxxxxxx>]

Forwarded mail replaces the original headers with the forwarder's details.
procmail searches only the headers by default, so you need to tell it to 
search the body:-

:0B:
From:.*wellsfargo\.com
/var/mail/clientsmailbox

The above searches ONLY the body. To search header as well...

:0BH:
From:.*wellsfargo\.com
/var/mail/clientsmailbox

I would leave the * ^ symbols off and just search for the string
Adding the \ before the . can't harm

Andy

At 07:07 AM 6/2/2005 -0400, you wrote:

> I think I solved the mystery this morning but it opens more questions for
> future filtering. I noticed in the log file that the wellsfargo.com stuff is
> showing up there as coming from devel_adm_mail@xxxxxxxxxxxxx That
> graphnet.com address doesn't show up anywhere in the headers. I'm not sure I
> understand (1.) where the log file gets devel_adm_mail@xxxxxxxxxxxx if it is
> no where in the headers, and (2.) why my rule (* ^From.*wellsfargo.com)
> wouldn't catch it from the headers.
>
> Hmmm... One more question that might be revealing. Do some email software
> programs (Outlook for example) translate the headers rather than displaying
> them all? I just noticed that the headers attached to this email have no IP
> numbers in them. This email was sent to me as an attachment by the client so
> I assumed that the headers hadn't been modified (I know my client doesn't
> know how to modify them). Does MS sanitize the headers or something? If this
> is true, is there a way to instruct a client to send un-munged headers? (I
> thought attaching the offending email to a new one should accomplish that).
>
> Thanks,
>
> Jim Smith
>
> > -----Original Message-----
> > From: owner-vps-mail@xxxxxxxxxxxx
> > [mailto:owner-vps-mail@xxxxxxxxxxxx] On Behalf Of Jim Smith
> > Sent: Wednesday, June 01, 2005 11:47 AM
> > To: vps-mail@xxxxxxxxxxxx
> > Subject: [vps-mail] Procmail rule help
> >
> > I need another set of eyes to look at this. I have a client
> > wanting to get
> > rate sheets from WellsFargo.com which of course the spam
> > filters have a
> > field-day with. So I put a rule at the top of the .procmailrc
> > that sez:
> >
> > :0:
> > * ^From.*wellsfargo.com
> > /var/mail/clientsmailbox
> >
> > Stuff is still going to the spam folder. Here are the headers
> > to one of the
> > messages:
> >
> > Reply-To: <corrrates@xxxxxxxxxxxxxx>
> > From: "Wells Fargo" <corrrates@xxxxxxxxxxxxxx>
> > To: "******" <david@*******.com>
> > Subject: Wells Fargo Subprime Rate Sheet
> > Date: Wed, 1 Jun 2005 10:56:37 -0400
> > Message-ID: <2545159.1117637850044.JavaMail.gnet@www3>
> > MIME-Version: 1.0
> > Content-Type: multipart/mixed;
> >       boundary="----=_NextPart_000_0075_01C5669D.94B389E0"
> > X-Mailer: Microsoft Office Outlook, Build 11.0.6353
> > X-ClamAV: clean
> > Thread-Index: AcVmujgJS7fkmv0GQ0aIMOraKnw+pg==
> > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
> >
> > The rule isn't working. What am I doing wrong?
> >
> > Thanks,
> >
> > Jim Smith
> >
> >
> >  --------------------------------------------------------
> >            Jim Smith, Blarneystone, LLC.
> >   Website Design, Hosting, Development & Enhancement
> >    E-MAIL:      jimsmith@xxxxxxxxxxxxxxxx
> >    WEBSITE:     http://www.blarneystone.com
> >  --------------------------------------------------------
> >
> > ======================================================================
> > This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
> > Before posting a question, please search the archives (see above URL).
> >
>
> ======================================================================
> This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
> Before posting a question, please search the archives (see above URL).

--------------------------------------------------------------------
PROTEUS - new anti-spam, anti-virus solution
www.proteus.lu

FOCUS Internet Services
Domains, Design, Hosting, Custom Applications, E-Commerce
106 rue de Mersch, L-8181 KOPSTAL, Luxembourg
tel. (+352) 305 197
fax (+352) 305 188
www.focus.lu  

======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).