cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
880
Views
0
Helpful
2
Replies
Highlighted
Beginner

Determine which word the filter caught

Is there a log on the ironport system that will report the affending word in an email caught in the profanity filter?                  

2 REPLIES 2
Highlighted
Participant

I haven't used the technology myself, but it looks as if you want the Add Log Entry action with the $MatchedContent variable.

If you are routinely running the logs through a utility like grep*, it might be an idea to add a few more variables like $MID and a token word "SPECIALRULE" to allow you to easily extract and process the hits.

Depending on your throughput, this may have some impact on your log file cycle rate.

* this assumes an external device; whilst far from useless, the CLI grep is quite tame compared to what's possible with a less limited shell.

Highlighted
Enthusiast

In case you are using a filter to move the offending message to a Policy Quarantine, you can also simply check that message in the quarantine, above the content there will also be a line showing which part was matching.

Hope that helps,

Andreas