[Rspamd-Users] Help Multiple symbols en filter

[Emanuel Gonzalez]

Hi.! i create a filter to match certain strings in a email body.

In the multimap.conf i add this rule:

BODY_CONTENT_RJT {
type = "content";
filter = "body";
map = "${LOCAL_CONFDIR}/local.d/body_reject.map.inc";
symbols = ["BODY001"];
prefilter = true;
regexp = true;
}

In the file body_reject.map.inc, add the string i need match:

(?i)\bBASE CAPITAL FEDERAL EN UN CD\b BODY001:1
(?i)\bNO DEPOSIT REQUIRED\b
(?i)\bEnviamos tambien un programa de envio de Mails\b
(?i)\bGanaDineroConEncuestas.com\b/
(?i)\bSuper Pack E-marketing\b

The rule work fine, but in the logs of rspamd i see this:

2019-12-23 07:26:27 #10887(normal) <69f88c>; task; rspamd_task_write_log: id: <SC1P215MB00649F24394D700BE49A588BB42E0 at SC1P215MB0064.LAMP215.PROD.OUTLOOK.C
OM>, qid: <1ijKuu-0004ay-WD>, ip: 40.92.40.11, from: <emanuel_gonzalez at live.com.ar>, (default: F (no action): [11.70/30.00] [BODY_CONTENT_RJT(15.00){},DMA
RC_POLICY_ALLOW(-2.00){live.com.ar;none;},ARC_ALLOW(-1.00){i=1;},R_SPF_ALLOW(-0.20){+ip4:40.92.0.0/15;},MIME_GOOD(-0.10){multipart/alternative;text/plain;
},ASN(0.00){asn:8075, ipnet:40.64.0.0/10, country:US;},FREEMAIL_ENVFROM(0.00){live.com.ar;},FREEMAIL_FROM(0.00){live.com.ar;},FROM_EQ_ENVFROM(0.00){},FROM
_HAS_DN(0.00){},MIME_TRACE(0.00){0:+;1:+;2:~;},MX_GOOD(0.00){cached: nam.olc.protection.outlook.com;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_THREE(0.00){4;},
RCVD_IN_DNSBL_JKM(0.00){40.92.40.11:from:127.0.1.1;40.92.40.11:from:127.0.0.3;},RCVD_TLS_LAST(0.00){},R_DKIM_NA(0.00){},TO_DN_EQ_ADDR_ALL(0.00){},TO_MATCH
_ENVRCPT_ALL(0.00){}]), len: 4913, time: 2357.325ms, dns req: 25, digest: <a7fb393a15ccfd68c04b610969233953>, rcpts: <emanuel at emadns.tk>, mime_rcpts: <ema
nuel at emadns.tk>

Should be logged the symbols BODY001 but no, i see logged the symbol BODY_CONTENT_RJT.

I created multiple symbols in a filter and they work, but in the message body filter no.

Any ideas? My sintax is bad?

Regards, Ema.