How to create Procmail filter that checks both headers and body

Question

I'm trying to create a Procmail rule based on all of From, Subject and a string in the body:

:0 B:
* ^From:.*[email protected].*
* ^Subject:.*fixed string in the subject line.*
* .*fixed string in the body.*
/dev/null

I'm trying to delete a persistently problematic mail source whose only safe option is to check all three of these.

What am I doing wrong here? Presumably this is something do do with the B flag?

Solution 1

You need both H and B if you want to match headers and body. See the Procmail Tips page, full of useful examples. Try

:0 HB
* ^From:.*[email protected]
* ^Subject:.*fixed string in the subject line
* fixed string in the body
/dev/null

(note, the above doc refers to a bug in version 3.22 whereby once HB is used further uses of just B will still look through H).

Solution 2

:0
* ^From:.*[email protected]
* ^Subject:.*fixed string in the subject line
* B ?? fixed string in the body
/dev/null

man procmailrc

variablename ??
Match the remainder of this condition against the value of this environment variable (which cannot be a pseudo variable). A special case is if variablename is equal to B, H, HB or BH; this merely overrides the default header/body search area defined by the initial flags on this recipe.

Comments

[george salib]

Thanks very much - that works, and as such as a great relief for my inbox! Am surprised I didn't come across any examples of this when searching.

[tripleee]

+1 This is the more useful answer, as you don't want to look for the From: and Subject: headers in the body of the message, or find the string in random other headers.

[tripleee]

The trailing : is more than useless here; the purpose of locking is to prevent the message from being mangled, but if you are ditching it anyway, you honestly won't care, and locking will consume some resources which are probably better spent elsewhere.

[tripleee]

Also the trailing .* in the regular expressions is redundant and useless.

[AnFi]

@tripleee I have used "minimal sample modification" approach.

[tripleee]

I can see that, but not fixing obvious errors in the OP's code would certainly warrant a comment to that effect at the very least.