Collin told Eric, seeing Eric was dropping some mail to /dev/null,
| Ouch!
Eric is *trying* to get rid of a lot of junkmail he receives, so it could be
that he wanted that piece lost.
| Alternately, rather than putting the msg into /dev/null, put it into
| "spam.Thu" or something like that (where the suffix comes from
| date(1)). You can do something like this to save one day's worth of
| messages. To prevent unsightly buildup of spam, you could be sure to
| purge "spam.Mon" after reviewing your logs Tuesday morning. (You could
| also uncomment the ":0 fbwi" recipe inside the block, but then you
| could only recover the first few lines of "false-positive" spam.)
|
| The following recipe is only minimally tested!
|
| :0
| * Looks_Suspicious ?? YES
| {
| TodaysSpam=spam.`date +%a`
It's inefficient to run the date binary for every incoming message. If the
items come in with From_ lines, use procmail's MATCH facility to extract the
day of the week from there.
| # :0 fbwi
| # | head
|
| :0
| $TodaysSpam
| }
Just in case the piece is not really spam, lock that folder (perhaps Collin
is used to saving to directories) with a second colon on the flag line.
Collin's suggestion is good, but I'd code it this way:
:0:
* Looks_Suspicious ?? YES
* ^^From +[^ ]+ +\/(Sun|Mon|Tue|Wed|Thu|Fri|Sat)
spam.$MATCH
I wouldn't filter it through head because, if it's a false positive, you'll
want to be able to read the whole thing. (If there were no risk of false
positives, the original dump to /dev/null would have been perfect.)
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail