Event and Object Analysis > Capture Results Filtering > Filtration Basics > Rules > Criteria and Conditions

Checks the size of the message.

Description

This condition checks the size of the message.

The msg-size condition sums up the size of the extracted text and attachments.

The total-size condition sums up the total size of the extracted text, attachments and source data from which they were extracted.

Format

<c name="msg-size" op="<operation>" value="<compare pattern>" />
<c name="total-size" op="<operation>" value="<compare pattern>" />

The "name" attribute:

The name attribute contains the condition name: name="msg-size" or name="total-size".

The "value" attribute:

The value="..." attribute specifies the number to which the message size is compared:

<number> or <number>B

Specifies the size in bytes.

<number>K

Specifies the size in kilobytes.

<number>M

Specifies the size in megabytes.

<number>G

Specifies the size in gigabytes.

The "op" attribute:

The op="..." attribute specifies the comparison operation and may have the following values:

"eq" or = or ==

The condition is considered true if the size IS EQUAL TO the specified number.

"ne" or != or <>

The condition is considered true if the size IS NOT EQUAL TO the specified number.

"lt" or <

The condition is considered true if the size IS LESS THAN the specified number.

"gt" or >

The condition is considered true if the size IS GREATER THAN the specified number.

"le" or <=

The condition is considered true if the size IS LESS THAN OR IS EQUAL TO the specified number.

"ge" or >=

The condition is considered true if the size IS GREATER THAN OR EQUAL TO the specified number.

Example:

The rule stops processing messages larger than 100 kilobytes (net of source data) or larger than 1 megabyte (including source data).

<?xml version="1.0" encoding="utf-8"?>
<filter name="Message filter" version="1.0">
<comment>Messages filter.</comment>

<table name="main">

<rule enabled="1">
<match>
<or>
<c name="msg-size" op=">" value="100K"/>
<c name="total-size" op="gt" value="1M"/>
</or>
</match>
<action name="drop" />
</rule>

</table>
</filter>

MSG-SIZE, TOTAL-SIZE condition

MSG-SIZE, TOTAL-SIZE condition