Table of Contents

Pattern Matching

Configuring ze-filter

Configure it : 

SPAM_REGEX                         YES
REGEX_FILE                         ze-regex
REGEX_MAX_SCORE                    50
SPAM_REGEX_MAX_MSG_SIZE            40000
SPAM_REGEX_MAX_MIME_SIZE           15000
DUMP_FOUND_REGEX                   YES
REGEX_LOG_FILE                     file:ze-regex

SPAM_REGEX_MAX_* controls the maximum size of mails to process as soon as spams emails are often less than 40K.

To get more information on actions, have a look here

Configuring Regexp

Edit /etc/ze-filter/ze-regex. The syntax is explain in the default file in commentary.

For example, to reject well known words in Subject: field, add the line : 

SUBJECT    1000 (c+(1|l|i)+(a|4)+(1|l|i)+s+|v+(1|l|i)+(a|4)+g+r+(a|4)+)

Reread files

After modifying ze-regex file, say it to ze-filter : 

$ ze-ndc RELOAD TABLES

cf. jndc documentation.

Comments

Filtering bodies (for examples with the same words as infra) is really fast as far as I can see on my mailhost. I use more complex expressions and ze-filter doesn't overload mailhost as milter-regex does.