Re: Multiple patterns for matching within socklog?

Lloyd Zusman <ljz <at> asfast.com> writes:

> [ ... ]
>
>   For service "mail", accept all messages which match "mail.*" and which
>   do not contain the string "imap".
> 
>   For a new service that I call "imap", accept all messages which match
>   "mail.*" and which do contain the string "imap".
> 
>   In other words, this splits "mail.*" log messages into two groups, one
>   with the word "imap" in them, and one without.  Then, each group gets
>   logged into separate files.

Well, I figured this one out, but now, I have a more complicated problem.
The way to do the one I mentioned above involves two sets of patterns.

For the "mail" case:
  +mail.*
  -*:*:*:*imap*

For the "imap" case:
  +mail.*:*:*:*imap*

(there's a yyyy:mm:dd stamp before the "imap" string)

However, the more complicated case goes like this:

  For a new service that I call "getmail", accept all messages which
  match "mail.*" and which also contain EITHER "pop" or "imap".

  For the "mail" service, accept all messages which match "mail.*" and
  which DO NOT contain "pop" nor "imap".

How to handle "or/nor" within a complex rule is now throwing me for a
loop.

Any ideas?

Thanks again in advance.