Cisco Cisco Email Security Appliance X1050 Guía Del Usuario
9-9
Cisco AsyncOS 9.1 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Processing
the total score. If you set the threshold value for the message filter to 6, AsyncOS would determine that
the threshold score has been met. Or, if the message contained one instance of each term, the total value
would be 6, and this score would trigger the filter action.
the threshold score has been met. Or, if the message contained one instance of each term, the total value
would be 6, and this score would trigger the filter action.
AND Test and OR Tests in Message Filters
When evaluating AND or OR tests within message filters, AsyncOS does not evaluate unneeded tests.
So, for example, if one side of an AND test is false, the system will not evaluate the other side. It is
important to note that the system does not evaluate the tests from left to right. Instead, when AND and
OR tests are evaluated, the least expensive test is evaluated first. For example, in the following filter, the
So, for example, if one side of an AND test is false, the system will not evaluate the other side. It is
important to note that the system does not evaluate the tests from left to right. Instead, when AND and
OR tests are evaluated, the least expensive test is evaluated first. For example, in the following filter, the
remote-ip
test will always be processed first because it has a lower cost than the
rcpt-to-group
test
(generally LDAP tests are more expensive):
Because the least expensive test is performed first, switching the order of the items in the test will have
no effect. If you want to guarantee the order in which tests are performed, use nested
no effect. If you want to guarantee the order in which tests are performed, use nested
if
statements. This
is also the best way to ensure that an expensive test is avoided whenever possible:
In a somewhat more complicated example, consider:
The system groups the expression from left to right, so this becomes:
This means the first thing the system does is compare the cost of
(test1 AND test2)
against the cost of
test3
, evaluating the second AND first. If all three tests have the same cost, then
test3
will be
performed first because
(test1 AND test2)
would be twice as expensive.
andTestFilter:
if (remote-ip == "192.168.100.100" AND rcpt-to-group == "GROUP")
{ ... }
expensiveAvoid:
if (<simple tests>)
{ if (<expensive test>)
{ <action> }
}
if (test1 AND test2 AND test3) { ... }
if ((test1 AND test2) AND test3) { ... }