I am new at this so sorry if it is a basic question.  I continue to try to write a regex expression that will allow all email to be unfiltered except for a certain number of email addresses.  I have 2 or more addresses that I want to filter during the eval of the product in our production environment...

for example

mailto:poptech@domain.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - poptech@domain.com

and

mailto:crosst@domain.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - crosst@domain.com

all other email addresses I want unfiltered.

so I wrote a regex expression I thought was pretty clever...it works with all the testing tools I find on the net but not in the regex test on the spamfilter system....any ideas...I really like this product so far and this would help greatly on the next stage of the eval...

my statement is      (^(?!crosst|poptech))  (added paren's for the actual filter but get an exception error when it evals the incoming mail.

Thanks

Terry

Terry,

We  now understand the reasons for your search of such an expression, it's an interesting idea. For the life of us, none of us here was able to come up with a RegEx that does the job though today...

Going back to your issue, you probably would like to test SpamFilter, but only for a limited amount of emails, youd like the other users to still receive all emails so you will not have to worry about blocking legitimate traffic during your eval.

Have you thought about using the "Tag spam and deliver" option in SpamFilter? It was designed with this purpose in mind. Incoming email that is identified as spam can simply be "tagged" as such by adding a hidden header (X-SF-SPAM:Y) in it. The email is then delivered to the end user. You can then apply client side filtering rules on the test email accounts in your email software to then move the "tagged" emails to a spam folder, which will allow you see the accuracy.

Roberto F.
LogSat Software

Well I had considered that earlier but I really was hoping to see how the quarantine process worked for the group also.   I will probably go ahead and try it your way for now.  Thanks a lot for the very rapid replies you have impressed me very much with the quick response to these questions.

Terry

Terry,

The problem with your expression not working is that SpamFilter's RegEx engine does not recognize the lookahead and lookbehind extensions, which I think you're using. There are several SpamFilter users who are much more knowledgeable than us in RegEx creations, we'll see if anyone accepts the challenge to come up with such an expression.

Roberto F.
LogSat Software

Terry,

Can you please detail EXACTLY what you are trying to do and what list you have your expression in?

Regards,

Dan S.

I am trying to do the exact opposite of the whitelist unfiltered process.  This tab appears to be designed to include specific email addresses that will not be filtered.  Okay..that will be a list of about a thousand addresses.  What I really want to do is filter only a few addresses to evaluate the product in production.  These few addresses get lots of spam and would be a great test bed.  I realize that I can do this pretty transparently using the header tagging process and write rules for the individual mailboxes in question however this does not test the quarantine process for retrieval which would be valuable item to use.

So I wrote a regular expression to select every email address except a very few.  These few would return negative and thus be filtered while the other 997 would return true and not be filtered.  Unfortunately the regex function I used is not supported by spamfilter (look ahead)..so at this time I am out of luck.

The expression I wrote was

^(?!crosst|frisit|splaww)

This represents the first part the email names that I do want to filter...so they should evaluate negatively and all others should be positive (meaning all others bypass the filtering).

Terry

Terry,

Doubtfull BUT ... are these 3 as short as you can get them and still remain unique?  And ... It may be easier if the unique part was just to the left of the "@" in the address.

Regards,

Dan S.

I don't believe I can be unique with less...matter of fact I am sure I can't.  These are also all the characters to the left of the @

Terry

Terry,

Let me think on this.  I will have to come up with a "Cheat" because this ia the reverse of what the filter lists actually do.

Dan S.

Thanks Dan.  Don't spend a lot of time with this....I can use the tag method if it isn't possible in other ways.

Terry

Hey....I think I actually came up with the combinations of regex statements that will do what I need to do for this evaluation...it takes about 20 statements to get 3 people only filtered and everyone else unfiltered but I think it is going to work...

Terry

Great job Terry! If you don't mind, I'm very curious to see how you managed to achieve what we failed to find!

Roberto F.
LogSat Software

Understand that I am new to regex so this might not be the most elegant solution but I think it is working and since I couldn't use forward or backward features it is the only way I could get it to work...

First I set the ranges that I won't filter in the list (accounts that are unfiltered)(notice c is not listed in these two expressions)

^[a-b]

^[d-z]

then I pick up any addresses that start with c but are not crosst - a little more complicated

^c[^r]

^cr[^o]

^cro[^s]

^cros[^s]

^cross[^t]

and this seems to work...it only filters the account(s) I want to test and lets all the rest (including the other accounts that start with c) through unfiltered.  If you see something wrong with the logic let me know...I also have included other accounts in this ..but haven't quite figured out how I would handle 2 or more accounts that might start with the same character..although for the test I don't need to accomodate this.

Terry

ooops...just found out something else...when you don't filter in this manner...then spamfilter lets anything go through...even if it isn't for my domain....this causes a problem as we suddenly look like an open relay to the outside world and they think they are sending emails through us ...so...back to the drawing boards...Terry