Content Filtering Not Detecting Email When Using "Does Not Contain"

Article:TECH158109  |  Created: 2011-04-14  |  Updated: 2013-10-27  |  Article URL http://www.symantec.com/docs/TECH158109
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution


Issue



A content filtering rule is configured with to use the Does Not Contain option.  The rule is not acting upon email messages that match items in the match term list.  The rule does act upon email messages where the message matches the first item in the match list.

These symptoms may be itermittent.

Conditions

  • The rule is configured to scan the message body using literal string matching with the Does Not Contain match terms.

Use the following steps to verify this:

1. Open the SMSMSE Administration Console.
2. Click the Policies tab. Then click the Content Enforcement|Content Filtering rules item.
3. Right click the rule and select Edit Rule....
4. The value of the dropdown Message part to scan is Message Body.  The value of Match Type is Literal String. The value of the Content dropdown is Does not Contain.

  • There is more than one entry defined in the match terms.

Perform the following steps while the rule edit is open from above:

1. Click on the match term list hyperlink in the Content textbox.  This brings up the Match Term dialog box.
2. Right click on the specified match term list and select Edit match list....
3. The number of items in the Filter textbox is more than one.


Cause



Improper handling of certain HTML formatted emails.


Solution



This issue is resolved in SMSMSE 7.0, please upgrade to version 7.0 to resolve this issue. 

Workaround

Remove the existing rule and then configure a rule to match all emails except those that match the terms in the match list. 

1. Remove the existing rule.

a. Open the SMSMSE Administration Console.
b. Click the Policies tab. Then click the Content Enforcement|Content Filtering rules item.
c. Right click the rule and select Delete Rule....  Click the OK button to delete the rule.

2. Add new rule.

a. Open the SMSMSE Administration Console.
b. Click the Policies tab. Then click the Content Enforcement|Content Filtering rules item.
c. Click the Tasks|New Rule... item.
d. Fill in appropriate items on the rule including Name, Description, Apply To, Message Part to Scan, Options.
e. Select the value Literal String for the dropdown Match type.
f. Select Contains for the Content dropdown.
g. In the Content textbox enter a star character (*).
h. Select Does not Contain in the Unless dropdown.
i. Click the Add match list... button.
j. Select the appropriate match list and click the Select button.
k. Fill in the data on the remaining content filtering tabs.
l. Click the OK button to save the rule.
m. Click the Deploy changes button.

 

 


Supplemental Materials

SourceETrack
Value2350782


Article URL http://www.symantec.com/docs/TECH158109


Terms of use for this information are found in Legal Notices