Cisco Cisco Email Security Appliance C160 Guía Del Usuario
5-303
Cisco IronPort AsyncOS 7.1 for Email Advanced Configuration Guide
OL-22164-02
Chapter 5 Using Message Filters to Enforce Email Policies
Writing Efficient Filters
This example shows two filters that do the same thing, but the first one takes much
more CPU. The second filter uses a regular expression that is more efficient.
more CPU. The second filter uses a regular expression that is more efficient.
attachment-filter: if ((recv-listener == "Inbound") AND
((((((((((((((((((((((((((((((((((((((((((((((attachment-filename ==
"\\.386$") OR (attachment-filename == "\\.exe$")) OR
(attachment-filename == "\\.ad$")) OR (attachment-filename ==
"\\.ade$")) OR (attachment-filename == "\\.adp$")) OR
(attachment-filename == "\\.asp$")) OR (attachment-filename ==
"\\.bas$")) OR (attachment-filename == "\\.bat$")) OR
(attachment-filename == "\\.chm$")) OR (attachment-filename ==
"\\.cmd$")) OR (attachment-filename == "\\.com$")) OR
(attachment-filename == "\\.cpl$")) OR (attachment-filename ==
"\\.crt$")) OR (attachment-filename == "\\.exe$")) OR
(attachment-filename == "\\.hlp$")) OR (attachment-filename ==
"\\.hta$")) OR (attachment-filename == "\\.inf$")) OR
(attachment-filename == "\\.ins$")) OR (attachment- filename ==
"\\.isp$")) OR (attachment-filename == "\\.js$")) OR
(attachment-filename == "\\.jse$")) OR (attachment- filename ==
"\\.lnk$")) OR (attachment-filename == "\\.mdb$")) OR
(attachment-filename == "\\.mde$")) OR (attachment-filename ==
"\\.msc$")) OR (attachment-filename == "\\.msi$")) OR
(attachment-filename == "\\.msp$")) OR (attachment-filename ==
"\\.mst$")) OR (attachment-filename == "\\.pcd$")) OR
(attachment-filename == "\\.pif$")) OR (attachment-filename ==
"\\.reg$")) OR (attachment-filename == "\\.scr$")) OR
(attachment-filename == "\\.sct$")) OR (attachment-filename ==
"\\.shb$")) OR (attachment-filename == "\\.shs$")) OR
(attachment-filename == "\\.url$")) OR (attachment-filename ==
"\\.vb$")) OR (attachment-filename == "\\.vbe$")) OR
(attachment-filename == "\\.vbs$")) OR (attachment-filename ==
"\\.vss$")) OR (attachment-filename == "\\.vst$")) OR
(attachment-filename == "\\.vsw$")) OR (attachment-filename ==
"\\.ws$")) OR (attachment-filename == "\\.wsc$")) OR
(attachment-filename == "\\.wsf$")) OR (attachment-filename ==
"\\.wsh$"))) { bounce(); }
In this instance, AsyncOS will have to start the regular expression engine 30
times, once for each attachment type and the recv-listener.
times, once for each attachment type and the recv-listener.