Thank you, Paul, for pointing out the existence of the logical AND in the interface, and thank you, Gordon, for finding it and posting the location. I'd searched the interface for a logical AND but failed to find it - I think I must have assumed that the actions listed under "then do this" would all take place at the end of processing.

I've input my rule using the interface and it works. Interestingly, the syntax for the AND is different from that in content control. Also, my manually input incorrectly formatted rule has disappeared, Mercury presumably having cleaning it up.

Chris

I would like to write a global rule which is more complex than the interface allows; I can see from examples posted on the Forum that complex rules are possible, but I can't find anywhere that describes the syntax.

My problem is this: I'm running Mercury 4.72 with SpanHalter. Occasionally, Spamhalter comes up with a false positive on mail from one local user to another, which I want to avoid. I know that I can't whitelist local users so I want to use global rules. While I quite often see spams with a forged From address the same as the To, I never see any with the forged From address of a different local user. I want to write rules something like

If header "F" contains [user1] AND header "T" contains [user2] THEN Exit

What would be the correct syntax for that (or is it not possible)?

Thanks, Chris

Chris - Others will know better than I do about this, but you talk about writing a global rule which is "more complex than the interface allows".  I am presuming, from this, that you are trying to use the Global Rules interface.  Have you tried editing rules.mer directly, with a text editor?  You still need to know the correct syntax of course, but you may be able to deduce this from your current rules.mer.  I am probably wrong about this, but I am wondering whether the syntax would be the same, or similar, to that used for message tests in Content Control.

GordonM

Thanks, Gordon. I did look in rules.mer but the rules I have at present are all generated through the interface and there are none which combine 2 events.

Good idea re Content Control - there's more detailed Help text for syntax in Content Control than I could find for Global Rules. It does look very similar to the examples of rules I've seen, so I will try writing a rule and see what happens.

 Chris

Update - I've put the following in rules.mer, to exit from rule processing before the rule to bin anything with a positive SpamHalter heading is processed, and it seems to work.

If header "T" contains "user1" AND header "F" contains "user2" Exit ""

[quote user="Chris Bolton"]

I would like to write a global rule which is more complex than the interface allows; I can see from examples posted on the Forum that complex rules are possible, but I can't find anywhere that describes the syntax.

My problem is this: I'm running Mercury 4.72 with SpanHalter. Occasionally, Spamhalter comes up with a false positive on mail from one local user to another, which I want to avoid. I know that I can't whitelist local users so I want to use global rules. While I quite often see spams with a forged From address the same as the To, I never see any with the forged From address of a different local user. I want to write rules something like

If header "F" contains [user1] AND header "T" contains [user2] THEN Exit

What would be the correct syntax for that (or is it not possible)?[/quote]

Use the 'Logical AND operator' in the interface to combine two (or more) rules together.

Paul - The original question wasn't mine, but I am interested in your answer.  I hadn't really noticed the "Logical AND operator" in the "Then do this" list.  I presume that, when a rule is ANDed, this is with the following rule.  Is that correct?

Gordon

[quote user="GordonM"]I presume that, when a rule is ANDed, this is with the following rule.  Is that correct?[/quote]

Yes, that's correct.

Thank you.  That may be useful.

Gordon