Thanks for your response Ian. The problem was spam getting through the filter despite having a high score and the filter correctly recognizing the fact but apparently doing nothing. The reason that I eventually tracked down was that I had followed the recommendation in the Exim book (pp 229&244) and had "if error_message then finish endif" at the start of the filter. The spams that were getting through all had empty envelope sender addresses which makes error_message true and stops further filter execution. Moving the spam checks ahead of this clause has fixed the problem.
On 4 Jun 2013, at 15:46, Ian Eiloart <iane@???> wrote:
> Does anything else work in the filter file? If not, then perhaps Exim isn't examining it.
>
> On 28 May 2013, at 22:46, Chris Bunch <chris@???> wrote:
>
>>
>> I have a .forward Exim filter file which (inter alia) contains the following statement:
>>
>> if $h_X-Oxmail-Spam-Level: contains "********"
>> then
>> seen finish
>> endif
>>
>> despite which emails with (for example) X-Oxmail-Spam-Level: ***********************
>>
>> which are correctly interpreted by the filter in verbose test mode (exim -bf -v .forward <email6.txt):
>>
>> ____________________
>>
>> Testing Exim filter file ".forward"
>>
>> Condition is false: error_message
>>
>> <snip>
>>
>> Condition is true: $h_X-Oxmail-Spam-Level: contains ********
>> Seen finish
>> Filtering set up at least one significant delivery or other action.
>> No other deliveries will occur.
>>
>> _____________________
>>
>> are still being delivered to my inbox rather than the promised 'black hole'.
>>
>> In all other respects the (quite detailed) filter operates correctly.
>>
>> Am I missing something? I am running the test(s) on a text copies of the 'successfully' delivered email(s). Is it possible that the headers post delivery are different from those encountered during normal processing of the .forward filter in some way that alters its interpretation?
>>
>> I am happy to share the full filter/test emails privately with anyone who can help.
>> --
>> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
>> ## Exim details at http://www.exim.org/
>> ## Please use the Wiki with this list - http://wiki.exim.org/
>
> --
> Ian Eiloart
> Postmaster, University of Sussex
> +44 (0) 1273 87-3148
>
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/
