diff --git a/config/filter.d/sendmail-spam.conf b/config/filter.d/sendmail-spam.conf index d4d812c7..c1477700 100644 --- a/config/filter.d/sendmail-spam.conf +++ b/config/filter.d/sendmail-spam.conf @@ -11,10 +11,20 @@ before = common.conf _daemon = sendmail -failregex = ^(?P<__prefix>%(__prefix_line)s\w+: )<\w+@[\w.-]+>\.\.\. No such user here(?P=__prefix)from=<\w+@[\w.-]+>, size=\d+, class=\d+, nrcpts=\d+, bodytype=\w+, proto=E?SMTP, daemon=MTA, relay=[\w.-]+ \[\]$ +failregex = ^(?P<__prefix>%(__prefix_line)s\w+: )<[^@]+@[^>]+>\.\.\. No such user here(?P=__prefix)from=<[^@]+@[^>]+>, size=\d+, class=\d+, nrcpts=\d+, bodytype=\w+, proto=E?SMTP, daemon=MTA, relay=\S+ \[\]$ [Init] # "maxlines" is number of log lines to buffer for multi-line regex searches maxlines = 10 +# DEV NOTES: +# +# There can be a nunber of non-related lines between the first and second part +# of this regex maxlines of 10 is quite generious. Only one of the +# "No such user" lines needs to be matched before the line with the HOST. +# +# Note the capture __prefix, includes both the __prefix_lines (which includes +# the sendmail PID), but also the \w+ which the the sendmail assigned mail ID. +# +# Author: Daniel Black