cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1638
Views
0
Helpful
6
Replies

ESA C600V empty subject AND empty body

slicciardola
Beginner
Beginner

Hi all,

i must implement the following rule with those content filtering criterias:

* subject:  empty

* body: empty

i've already done some tests.

Subject --> equals (or containts)= ^$

Body --> contains= ^$

if i set the condition on "if one or more is matched" it works, if i set the condition on "only if all conditions match" , and i need the second one, the combination of both.

can someone help me?

Thanks

6 Replies 6

Libin Varghese
Cisco Employee
Cisco Employee

Hi,

Our content search filter conditions (i.e. body-contains, attachement-contains, etc) all search line by line; like grep. We can search for empty lines (^$).... However, most emails have at least one empty line in the body section, so there would be many, many FPs.

I suggest reviewing examples of these 'no body' emails. There may be something else that these emails have in common that can be detected in filters.

Also, just because it looks 'empty' to the human eye, doesn't mean it is truly empty. There many be whitespace, html code, or unprintable characters. So make sure to look deep (i.e. packet capture, archive via Message Filter, or injection debug logs).

Thanks

Libin Varghese

Hi Libin and thanks for the answer.

we looked and we found really blank ones.

So, the reason why the AND conditions is not working is because it cannot work? Is made by default that is not going to work?

Hi,

The content filter conditions would work as expected with the AND OR conditions.

How it works would depend on the email sample you are testing with, I would recommend saving the original email as .eml and then opening it in a text editor to review the actual contents on the email.

- Libin V

hi,

i am testing with my blank email.

if i use the OR condition, it works, if i choose the AND condition it doesn't work,

that's why i am getting really mad!

You can certainly open a TAC case to get the filter reviewed and tested with the email sample.

- Libin V

ok, at this point my only choice is to open a case,

thanks!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers