Message filter sendergroup ALL problem

[Henk Fictorie - Ulrich]

I need to log hits to the sendergroup ALL, so I've written a very simple messagge filter:

Log_ALL_HIT: if sendergroup == "ALL" {

log-entry ("Mail from $RemoteIP has match with ALL sendergroup");

}

But when I look in the message tracking I don't see that this log-entry is hit. When I search for hits on this message filter I don't get any hits.

I do see message tracking details like:

(ICID 23456) ACCEPT sender group ALL match ALL SBRS rfc1928 country not applicable

but no log-entry generated by the message filter.

What I going wrong here?

kind regards Henk Fictorie - Ulrich

[Henk Fictorie - Ulrich · Accepted solution]

I've solved my own problem.

The sendergroup ALL is only called ALL in the GUI. For message filters the name "None" should be used.

I also found this: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/212588-how-do-i-match-the-sender-group-all-wi.html 

Henk