Print Page | Close Window

String matching error

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6476
Printed Date: 15 March 2025 at 2:48am


Topic: String matching error
Posted By: Shade
Subject: String matching error
Date Posted: 06 May 2008 at 8:45am
Dear All,

I've got a "String matching error" in my logs. I know SF 4.x skip bad regex, but is there a way to know which regex doing this error ? I've got about 2000 differents complex regex lines, and it's a bit complex to check it all...

Thank you for replies !

Best regards,
Shade.




Replies:
Posted By: Desperado
Date Posted: 06 May 2008 at 10:27am
Shade,
 
The log entry itself should indicate the expression but I need to go back a few months in my logs to find an example.


-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com



Posted By: Shade
Date Posted: 06 May 2008 at 11:01am
Thank you for reply;

Here is some lines of my logs :

05/06/08 00:00:05:842 -- (948) String matching error for (received: from 99.150.191.217 by XXXX (spamfilter); thu, 6 may 2008 00:00:05 +0200 -- received: from [51.49.140.233] (helo=pdu) --     by adsl-99-150-191-217.dsl.sfldmi.sbcglobal.net with smtp (exim 4.62 (freebsd)) --     id 1k˜2k˜-0001op-2 --and-- (.) : TRegExpr(exec): Not Assigned Expression Property

But in fact, I can't see any expression of this type in my regex list...

Thank you for help... Again Big%20smile


Posted By: LogSat
Date Posted: 06 May 2008 at 4:31pm
Shade,

I think the RegEx in your list causing issues is the following:

(.)


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Shade
Date Posted: 06 May 2008 at 6:53pm
Roberto,

You've got this list in my zip... As you can see, there's no (.)...
Thank you for help on this one ! :-)


Posted By: LogSat
Date Posted: 06 May 2008 at 10:27pm
Tricky one. Check your two keywords:

(. omari.com)
(. etcomvad.com)

They have a hidden #0A character (line feed) after the period. That confused the logging as well!


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Shade
Date Posted: 09 May 2008 at 1:51am
That was it ! Thank you again roberto !

Best regards.




Print Page | Close Window