<div dir="ltr"><div>Thanks Damian. I could understand it with the reading.</div><div><br></div><div>This works:</div><div><br></div><div><br>### <a href="http://www.drweb.com/">http://www.drweb.com/</a><br>['Dr. Web Security Space ',<br>'drweb-ctl', 'checkmail {}',<br>   qr/\bOK$/m,                          # Clean, skipped<br>   qr/\bReject/m,                       # Not clean<br>   qr/infected with (.*)$/m ],      # Name of virus<br><br><br><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Feb 20, 2022 at 11:08 AM Damian <<a href="mailto:amavis@arcsin.de">amavis@arcsin.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> ['Dr. Web Security Space ',<br>
> <br>
> 'drweb-ctl', 'checkmail {}',<br>
> <br>
> qr/^Reject/m,,<br>
> <br>
> qr/^(?:infected with:\s+(.+)/m ],<br>
<br>
Have a look at [1].<br>
<br>
- Both your patterns anchor at beginning of line.<br>
- A clean mail would not match "Reject" anywhere, but you defined it for the "clean" pattern.<br>
<br>
[1] <a href="https://gitlab.com/amavis/amavis/-/blob/master/lib/Amavis/AV.pm#L960-997" rel="noreferrer" target="_blank">https://gitlab.com/amavis/amavis/-/blob/master/lib/Amavis/AV.pm#L960-997</a><br>
</blockquote></div>