Limit notificatons?

[andreas.deland]

Hello

Are running the following filter for outgoing high volume mailes

Highvolume: if header-repeats('mail-from', 500, 'outgoing') {
                notify ("email@xxx.com");

Is it possible to limit the amout of notifications you get from the ESA?  As for now it seems like i get one notification for every time the filter get triggered..

Any suggestions are appreciated

//Andreas

[tsilveruits]

As far as I know, it is not possible to limit these notifications to one for a set time period on the ESAs, such as once per 10 minutes, half hour, hour, etc. which would be a nice feature. We had an outgoing content filter that triggered on numerous emails and sent us numerous notifications. So, we now have a 'swatch' program running on our Syslog server that handles the notifications now. If you've never used 'swatch' before, it's pretty easy to understand with a little scripting and regex knowledge.

[marc.luescherFRE]

This feature is currently not available for message or content filters and has been requested in the past.

[charella]

Andreas.deland,



You wrote: We are running the following filter for outgoing high volume mailes

Highvolume: if header-repeats('mail-from', 500, 'outgoing') {
notify ("email@xxx.com");

This appears to be working as designed. Notification from a message filter is different than an alert notification.

It’s simply matching, then sending a mail to the recipient.



What are you trying to achieve with this filter?

To capture users who send out a large volume of mail yes?

You could change the number, increasing to a higher number 800 or 1000.

You could add a second condition which makes it match less frequently.
if (header-repeats('mail-from', 13,'outgoing') And (body-size > 1M)

That’s an example, you can refer to the filter rules in the user guide to match your scenario,

Thank you,
Chris

[andreas.deland]

Hello

I just want to find out  when some one internal sending massmail, for example with an compromised account or virus.

Sure the value may be a litle low.

Regards

//Andreas

[Cristian Matei]

Hi,

   ESA does not support summarisation of such notifications.

Regards,

Cristian Matei.