When I suggested, stating explicitly that I was oversimplifying,
: | :0: # the brackets enclose caret, space, tab
: | * ^From:(.*\<)?_[^ ]*@
: | /var/log/Badtrans
Eric Krichbaum found some false positives that made sense (one address's
local part included "-_" and the other "&_") and two false negatives that I
can't explain. (A false positive is disappointing but harmless as long as
you don't treat positives rashly with actions such as deleting them unseen
or autoreplying to them that the sender has a virus.) Don Hammond has
responded,
| ... in this case you should be able to get by
| with something as simple as:
|
| :0:
| * ^From:.*<_
| /var/log/Badtrans
|
| or if you want to tighten it up a bit more:
|
| :0:
| * ^From:.*<_[^ ]*(_at_)[^ ]+>
| /var/log/Badtrans
Both of those depend on an assumption that every Badtrans dispatch will have
the address inside angle brackets. If Badtrans can be relied on to act that
way, then by all means go with Don's recommendation. (Note, folks, that "<"
in Don's code is a literal left-side angle bracket and "\<" in mine is a
procmailrc regexp for any non-word character.)
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail