Writing Message Filters Script via CLI

Is there any document to refer while writing scripts for message filters?
My ESA is on version 8.0.1 and I am unable to make text "case insensitive" while checking that text under "contains" rule? Is there any mechanism to look for text by ignoring the case?

using (?i) in either message or content filter will allow case insensitivity to be used.
Ex.
subject == "(?i)\\[SEND SECURE\\]”
* Q: What does (?i) do? Case insensitivity. Allows for “[SEND SECURE]”, “[send secure]”, “[SeNd SeCuRe]”, etc.
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118013-config-cdc-00.html
See either the Email Security End User Guide, or the older Advanced Configuration Guide - and look for the "Using Message Filters to Enforce Email Policies" section for full information and examples!
http://www.cisco.com/c/en/us/support/security/email-security-appliance/products-user-guide-list.html
I hope this helps!
-Robert
(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

Similar Messages

Edit Cluster Start-stop- and Monitor-Scripts via Bash?

Hi,
is there a way to edit (and sync!) the Cluster-Scripts via CLI?
Regards
Bernd

The short answer is no. The scripts are stored in eDir, and NCS keeps revisions of them internally. The best place to edit them is iManager. Alternatively, you can directly change the eDir attributes for those scripts while cluster is down.
That said, everything that iManager does comes in through a file interface. If you goal is to script resource modification, you can always access the file interface directly.
Regards,
Changju
Originally Posted by toblerone
Hi,
is there a way to edit (and sync!) the Cluster-Scripts via CLI?
Regards
Bernd

ESA want to retreive logs via cli

hi,
i want to retrieve message tracking logs via cli
Can some body let me know the procedure

Retrieve as in FTP copy them? Or retrieve as in setup syslog to push the logs off to a local syslog server?
Message tracking cannot be retrieved from CLI. Only the mail_logs --- which are used to compile the message tracking DB on the appliance(s).
From the User Guide, 34-36:
Tracking logs record information about the email operations of AsyncOS. The log messages are a subset of the messages recorded in the mail logs. The tracking logs are used by the message tracking component to build the message tracking database.
If you are trying to get the mail_logs...
You'll need to configure your logs via CLI: 'logconfig' or GUI: System Administration -> Log Subscriptions. Edit, or suggested to create a new/copy of the log you are needing off-appliance, and set the push as needed per your environment ---
From the User Guide, 34-6:
Log Retrieval Methods
Log files can be retrieved based upon one of the following file transfer protocols. You set the protocol while creating or editing the log subscription in the GUI or via the logconfig command during the log subscription process.
Log Transfer Protocols
Manually Download
This method lets you access log files at any time by clicking a link to the log directory on the Log Subscriptions page, then clicking the log file to access. Depending on your browser, you can view the file in a browser window, or open or save it as a text file. This method uses the HTTP(S) protocol and is the default retrieval method.
NoteUsing this method, you cannot retrieve logs for any computer in a cluster, regardless of level (machine, group, or cluster), even if you specify this method in the CLI.
FTP Push
This method periodically pushes log files to an FTP server on a remote computer. The subscription requires a username, password, and destination directory on the remote computer. Log files are transferred based on a rollover schedule set by you.
SCP Push
This method periodically pushes log files to an SCP server on a remote computer. This method requires an SSH SCP server on a remote computer using the SSH1 or SSH2 protocol. The subscription requires a username, SSH key, and destination directory on the remote computer. Log files are transferred based on a rollover schedule set by you.
Syslog Push
This method sends log messages to a remote syslog server. This method conforms to RFC 3164. You must submit a hostname for the syslog server and choose to use either UDP or TCP for log transmission. The port used is 514. A facility can be selected for the log; however, a default for the log type is pre-selected in the dropdown menu. Only text-based logs can be transferred using syslog push.
If you are wanting to just copy over a specific set of logs for a one-time review or to provide... then, assure that FTP is enabled on the interface. Then, using standard CLI from your desktop - ftp <IP/hostname>. You'll be in the /configuration directory when you finish authenticating onto your appliance. After - just simply use standard FTP commands to retrieve the log files you are after.
Ex.
$ ftp myesa
Connected to myesa.
220 myesa.local Cisco IronPort FTP server (V8.0.1) ready
Name (myesa:robsherw): admin
331 Password required.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (XXX,16,6,165,16,243)
150 Opening ASCII mode data connection for file list
drwxrwx--- 4 root config 1024 Apr 25 10:02 configuration
drwxrwx--- 2 root config 512 Jun 2 2013 captures
drwxrwx--- 2 root config 512 Jun 2 2013 diagnostic
drwxrwx--- 2 root log 512 Apr 25 09:58 upgrade_logs
drwxrwx--- 2 root log 1024 Apr 25 09:58 authentication
drwxrwx--- 2 root log 512 Apr 25 09:58 system_logs
drwxrwx--- 2 root log 512 Apr 25 09:58 cli_logs
drwxrwx--- 2 root log 512 Apr 25 09:58 trackerd_logs
drwxrwx--- 2 root log 512 Apr 25 09:58 reportd_logs
drwxrwx--- 2 root log 512 May 2 15:35 slbl_db
drwxrwx--- 2 root log 512 Apr 25 09:58 ftpd_logs
drwxrwx--- 2 root log 512 Apr 25 09:58 euq_logs
drwxrwx--- 2 root log 512 Apr 25 09:59 updater_logs
drwxrwx--- 2 root log 512 Apr 25 09:59 euqgui_logs
drwxrwx--- 2 root log 512 Apr 25 10:01 reportqueryd_logs
drwxrwx--- 2 root log 512 Apr 25 10:02 mail_logs
drwxrwx--- 2 root log 512 Apr 25 10:02 status
drwxrwx--- 2 root log 1024 Apr 25 10:02 asarchive
drwxrwx--- 2 root log 512 Apr 25 10:02 bounces
drwxrwx--- 2 root log 512 Apr 25 10:02 error_logs
drwxrwx--- 2 root log 1024 Apr 25 10:02 avarchive
drwxrwx--- 2 root log 512 Apr 25 10:02 crash_archive
drwxrwx--- 2 root log 512 Apr 25 10:03 sntpd_logs
drwxrwx--- 2 root log 512 Apr 25 09:59 gui_logs
drwxrwx--- 2 root log 1024 Apr 25 10:04 scanning
drwxrwx--- 2 root log 512 Apr 25 10:04 antispam
drwxrwx--- 2 root log 512 Apr 25 10:04 repeng
drwxrwx--- 2 root log 512 Apr 25 10:04 antivirus
drwxrwx--- 2 root log 512 Apr 25 10:04 encryption
drwxrwx--- 2 root log 512 Jan 23 10:55 domain
drwxrwx--- 2 root log 1024 Feb 27 21:21 domain_3
drwxrwx--- 2 root log 512 Jan 23 10:55 domain_2
drwxrwx--- 2 root log 512 Apr 25 09:58 slbld_logs
drwxrwx--- 2 root log 512 May 2 15:35 slbl_isq_db
drwxr-xr-x 3 root log 512 Feb 6 00:00 periodic_reports
drwxrwx--- 2 root log 512 Apr 25 09:58 snmp_logs
You can then use standard FTP/UNIX commands to navigate through the directory structure, cd mail_logs, for example and mget the files.
Ex.
ftp> cd mail_logs
250 CWD command successful.
ftp> ls
227 Entering Passive Mode (XXX,16,6,165,13,125)
150 Opening ASCII mode data connection for file list
-rw-rw---- 2 root log 1399268 May 6 15:33 mail.current
-rw-rw---- 2 root log 1399268 May 6 15:33 [email protected]
-rw-rw---- 1 root log 145117 Feb 10 11:58 [email protected]
-rw-rw---- 1 root log 167043 Feb 11 12:03 [email protected]
-rw-rw---- 1 root log 1943018 Mar 4 14:14 [email protected]
-rw-rw---- 1 root log 2404319 Feb 27 09:40 [email protected]
-rw-rw---- 1 root log 1822273 Mar 20 11:58 [email protected]
-rw-rw---- 1 root log 1267 Mar 4 14:40 [email protected]
-rw-rw---- 1 root log 3415936 Apr 24 12:55 [email protected]
-rw-rw---- 1 root log 67740 Mar 24 16:48 [email protected]
-rw-rw---- 1 root log 70220 Feb 7 15:29 [email protected]
226 Transfer Complete
ftp> mget mail.@*
mget [email protected] [anpqy?]? a
Prompting off for duration of mget.
227 Entering Passive Mode (XXX,16,6,165,180,210)
150 Opening Binary mode data connection for file '[email protected]'
2% |***
And so it will copy those off...
Once complete - the files will now be in the directory on your local desktop.
I hope this helps!
-Robert
(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

Error while trying to add a SQL Script via DB02

Good Morning and happy Sysadmin day to everyone,
I have the following Problem regarding DB2 9.5
I'm trying to run a SQL Script via DB02 in an ERP 6.0 System.
I'm using DB02 -> Jobs -> SQL Script Maintenenace -> Add
Then there is a Textfield "Script Name". When i'm using the F4-Help I'm getting the following error Message:
List box value range for field DYN_SED-SCRIPT_NAME could not be created
Message no. DB6PM004
Any suggestions what might be the Error?
Thanks in Advance
Marco

Are you trying to create a new Model or trying to import a Model ?

I;m no longer able to use the Penn State ANGEL system (I teach on line) for my email and intead get messages about "script" problems.

Question
I'm no longer able to use the Penn State ANGEL system (I teach on line) for my email and instead get messages about "script" problems

I have asked a moderator to provide assistance, they will post an invite on this thread.
They are the only BT employees on this forum, and are a UK based team of people, who take personal ownership of your problem.
Once you get a reply, make sure that you are logged into the forum, then click on their name, you will see a screen like this. Click on the link as shown below.
Please do not send them a personal message, as they may not be on duty for a long time, and your message will not be tracked properly.
For your own security, do not post any personal details, on this forum. That includes any tracking number you are give.
They will respond either by phone or e-mail within 5-6 working days.
Please use the tracked e-mail, to reply, not via the forum. Thanks
This is the form you should see when you click on the link. If you do not see this form, then you have selected the wrong link.
When you submit the form, you will receive an enquiry number, so please keep a note of it
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

Unable to login to ISE 1.2 via Cli

Hi,
I have a weird problem; after changing the default admin password on cli and rebooting the unit; i am no longer able to login via cli. Instead I get the following message:
% Error: Unable to launch ADE-OS shell. Disk full.
The ISE is running 1.2 with patch 3 installed.
If I try to access via web, it is running normally. I was wondering if anyone encounter such issue and any suggestions on how to fix it?
Any suggestion is appreciated.
Thanks.

Hi ,
you may be probably hitting one of these two defects.
CSCuj52520 or
CSCuj97832.
There are workarounds for these two defects and initially we need to know if it is the problem due to Admin user previleges corruption or issue with MNT DB growing in size and occupying the entire tablespace.
I suspect this could be a Admin privilege corruption and can be fixed with Rescue ISO image.
Can you please raise SR with TAC who can provide you with Rescue ISO image and help you in implementing the workaround.

Tool Pallete - Advanced - Message Handling Script/Script

We have few clarifications in OEDQ.
Tool Pallete -> Advanced -> Message Handling Script/Script:
we can write Java Script to define processing logic that acts across all the records in a message, or that acts selectively on only the first record in the message.
I tried writing Java Script for Data Validation and to display the message.
Java Code:
Public static void main(String[] args)
int EMPNO;
if(EMPNO = "123456")
system.out.println("Invalid EMPNO");
else
system.out.println("Valid EMPNO");
When we try to run the processor, We are getting the below error.
"error during process preparation
error in script: Error compiling Script: Missing ; before statement"
We are not getting error when we try to write a C program for the Message Handling Script.
C program:
var res=' '
var res1=' '
var res2=' '
if(input1=='US'){
res='Valid Country Code';
output1=res;
else if (input1=='UK')
res1='Valid Country Code';
output1=res1;
else
res2='InValid Country Code';
output1=res2;
Could you please let us know whether Java code can be used in Message handling script and can we have the header "Public static void main(String[] args)" in the script.
Thanks for your time.

Hi,
See the OEDQ online help here
Search for "Script" and "Message Handling Script"
You can use JavaScript or Groovy but NOT Java. Also the script needs to adhere to certain interfaces to allow it to be called by EDQ. See the examples provided.
regards,
Nick

Whenever I use facebook I'm getting this error message [Java Script Application] Error: options is undefined whenever I click on a link. What can I do to fix this problem? Easy step by step instructions please.

When I use facebook, I keep getting this message [Java Script Application] Error: options is undefined whenever I try to return something, click on a link, or message, open a game, etc. ... I have Windows 7, addons of greasemonkey and better facebook (which seems to have disappeared)
== URL of affected sites ==
http://www.facebook.com/reqs.php#!/?ref=home

Start Firefox in [[Safe Mode]] to check if one of your add-ons is causing your problem (switch to the DEFAULT theme: Tools > Add-ons > Themes).
See [[Troubleshooting extensions and themes]] and [[Troubleshooting plugins]]
If it does work in Safe-mode then disable all your extensions and then try to find which is causing it by enabling one at a time until the problem reappears.
You can use "Disable all add-ons" on the [[Safe mode]] start window to disable all extensions.
You have to close and restart Firefox after each change via "File > Exit" (Mac: "Firefox > Quit"; Linux: "File > Quit")

Message filters vs Content Filters

Differences:
1. Message filters occur earlier in the email pipeline than content filters. Message filters before the email goes into the workqueue. The content filters occur inside the workqueue.
2. Message filters are currently only administered from the command line. Content filters can be administered from both the CLI and the GUI interface, however, the GUI interface is the recommended mehtod.
3. Content filters have an inbound and an outbound set of content filters, depending upon the direction of the message. That is, whether it's a relayed email (outgoing content filters) or inbound mail(inbound content filters). Message filters on the other hand, are autmoatically applied to both inbound and outgoing traffic, unless you lock it down to a specific listener. If you only have one listener, you may need to differentiate your flow of traffic by sendergroups or something else.
4. Message filters and content filters can pretty much have the same conditions and actions. However, message filters allow for if-else conditions, so they are more robust.
5. You can use message and content filters in unison. For example, use a message filter to insert a custom header that you content filter can key off of. However, this does not work the other way around. You cannot insert a custom header in the content filter and have the message filter key off of that info. Due to the way the email pipeline is set up, message filters come first, then content filters.
6. Easy of use: content filters are a bit more intuitive and user-friendly. message filters are more advanced, so it has a bigger learning curve.
7. Content filters used with customized incoming or outgoing mail policies allow you to splinter messages. Splintering messages allow you to split messages up by recipients. Message filters don't allow splintering and are applied to the entire message.
AsyncOS User Guide: Content Filters Overview
https://support.ironport.com/docs/c_series/4.6/HTML_4.6_Compilation/AsyncOS_4.6_User_Guide/AsyncOS_4.6_User_Guide-12-3.html
AsyncOS User Guide: Message Filters
https://support.ironport.com/docs/c_series/4.6/HTML_4.6_Compilation/AsyncOS_4.6_Adv_User_Guide/AsyncOS_4.6_Adv_User_Guide-09-2.html
AsyncOS User Guide: Email Pipeline
https://support.ironport.com/docs/c_series/4.6/HTML_4.6_Compilation/AsyncOS_4.6_User_Guide/AsyncOS_4.6_User_Guide-09-2.html

Actually, I just did a test on this and your point is half correct.
It's not the content filter that does the splintering, it's either the incoming or outgoing mail policy that does the splintering.
For example, if you only have one Default outgoing policy and an outgoing content filter that drops the mail if the destination is @yahoo.com.
If you sent in a test email with two recipients: [email protected] and [email protected]
Then the entire message would get dropped since there was only one Default outgoing policy.
However, you can allow for splintering if you had additional custom policies.
For example,
1. gmail-recipients
2. yahoo-recipients
3. Default policy
In that case, your test email would split into two separate emails and then you could have the content filters apply to each separately.
You are correct that message filters apply to the entire message and does not allow for message splintering.
However, content filtering, message splintering is only applicable if you have additional custom policy, either inbound or outgoing.
So, in additional to the requirement of mutliple recipients, you also need multiple policies, otherwise, have multiple recipients and only one Default policy will affect the entire message also.
Thanks for the attention to detail.
You've missed one of the biggest differences...
Message filters act on a _message_. Content filters act on a message/recipient pair.
If a message is only going to a single person then there's not any difference, but if a message is addresses to multiple people then the message filter will take the same action for all recipients, whilst the content filter will split ("splinter") the one message into multiple messages, with one (or possibly more) recipients each, and then act on each individually.

How to setting ip address air lap 1262N-A-K9 via CLI?

as my title, can we configure ip address air lap 1262N-A-K9 via CLI?
Thanks for any responses

Hi,
Do you console access or telnet/ssh to device?
What message do you get when you type above command?
Regards
Najaf
Please rate when applicable or helpful !!!

Executing powershell script via task scheduler

Hello,
I am trying to execute powershell script via windows task scheduler which will forcefully delete all email in a mailbox, but I am getting the below errors
Operational Code - 2
Task Category - Action Completed --- Task Scheduler successfully completed task "\IL98" , instance "{2b193375-cbd2-4986-918d-3cfd4027d6b6}" , action "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" with return code 0.
Last Run Result - 0X0
When I am adding additional cmdlets in the script "Set-ExecutionPolicy Unrestricted", I am getting Last Run Result 0X5 rest of the error remains the same.
Powershell version - 3.0
Task Scheduler version - 1.0
If I try to run the script manually via Exchange Powershell the script executes without any errors
Thanks in Advance,
Ankush Shah

I figured out the problem, there wasn't any problem with the script but I had to correct inputs in windows task scheuler
Below is the resolution:
Under Actions:
Program/Script --> ws\System32\WindowsPowerShell\v1.0\powershell.exe
Add Argument --> -noexit -command ". 'C:\Program Files\Microsoft\Exchange Server\V14\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto
; <filepath>"
Eariler I was writing the filepath after double quote "
Also I have selected the option "Run with Highest Privilages" to avoid
0x5 error

Device reboot via CLI template in PI1.3

Hi together,
Is there any possibility to force a device (e.g. a switch/router) reload via Prime Infrastructure 1.3?
I tried using a simple reload command via cli template, but it doesn't work for me.
Thanks for your answers.
Regards
Sebastian

Did you get anywhere with this? I want to do something similar, configure just some port, not all ports. Prime seems to work by deploying templates to device groups, but I want it to deploy by device and port groups. Sadly it seems port groups are just monitoring filters only.
There only appears to be 17 DB variables in Prime at the moment and none of them are interface description.
I don't know if you can edit the CLITemplateDbVariablesQuery.properties file to add some more.
I don't understand why the port of port groups isn't available to configuration deployment.

Is there a software in which I can hook up my iPhone 4s to my computer and send and receive text messages and calls (via headset) through my computer?

Is there a software in which I can hook up my iPhone 4s to my computer and send and receive text messages and calls (via headset) through my computer? Whether it's free or cost money, can someone please give me a name of a program or software that allows me to do this? I can't seem to find anything like this for the iPhone.

No.

I upgraded to version 5 and now cant open firefox due to error message about script

When I try and open version 5 I get this message " A script on this page may be busy or may have stopped responding, you can stop the script now or you can continue to see if the script will complete"
Error message
Script: chrome://tavgp/content/libs/include.js:595. If I click the stop script button in the error message box firefox eventually opens, if I click the continue box it wont open. I have a fast computer with heaps of Ram and hard drive space running windows xp pro. I have uninstalled and reinstalled firefox, then rebooted even gone back to an earlier restore point but it still wont work. please please can someone help me as version 4 was perfect. really frustrating as I love firefox:-(

If you use ZoneAlarm Extreme Security then try to disable Virtualization.
*http://kb.mozillazine.org/Browser_will_not_start_up#XULRunner_error_after_an_update
See also:
*[[/questions/880050]]

When using Message Filters on an IMAP account I often get duplicate messages in my local folder where important messages are put. How can I stop this?

Since switching to IMAP and using message filters, I often get duplicate messages in my local folders. I think this is a bug.
That is my guess as to what is happening.
When the IMAP part starts syncing with the server to fill in the inbox, the message filter system starts working before it is done syncing. I appears that the filters runs too quickly because as the filter moves a msg to a local folder, the sync thread think it need to download it again from the server. If the sync with the remote server takes a long time, I could end up with 5 or more copies of the exact same email.
This has always happened for years now but I figured someone would have noticed it and fix it by now. Now I am wondering it it has something to do with my filters or my settings.
Has anyone run into this before?

Toys,
I was just doing a search to see if anyone else was feeling this way! I am also at a university and I don't really like see thousands of unread messages in mail. (Fortunately, with Leopard you can select the dock icon to show only the messages in your inbox but I still don't like having the public folder in there).
Please let me know if you find out anything and I will do the same for you. If I have time later I am going to run by our IT office later and ask them.

Writing Message Filters Script via CLI

Similar Messages

Maybe you are looking for