The system those not send a "557 This email is rejected  "if keyword is found still email is quarantined, what could be the problem

03/09/05 11:50:51:517 -- (2976) Connection from: 195.238.3.234  -  Originating country : Belgium
03/09/05 11:50:51:658 -- (2976) Resolving 195.238.3.234 - outmx007.isp.belgacom.be
03/09/05 11:50:51:704 -- (2976) viasoc.be is a domain, searching for SPF record
03/09/05 11:50:51:720 -- (2976) - SPF analysis for viasoc.be done: - none
03/09/05 11:50:51:720 -- (2976) Mail from: mailto:Tania.DeBuck@viasoc.be - Tania.DeBuck@viasoc.be
03/09/05 11:50:52:297 -- (2976) - MAPS search done...
03/09/05 11:50:52:297 -- (2976) RCPT TO: mailto:koenraad@khd.be - koenraad@khd.be accepted
03/09/05 11:50:52:562 -- (2976) String matching error for (from 195.238.3.234 by  (logsat software smtp server) wed, 9 mar 2005 11:50:52 +0100 from outmx007.isp.belgacom.be (localhost [127.0.0.1]) by outmx007.isp.belgacom.be (8.12.11/8.12.11/skynet-out-2.22) with esmtp id j29aqyng008146 for < mailto:koenraad@khd.be - koenraad@khd.be >; wed --and-- (valtrex|zyrtec|\bhgh\b|ambien\b|flonase|allegra|didrex|reno va\b|bontril|nexium)[\w\-_.]*\.[a-z]{2,}     # Fourth drug super regexp) : TRegExpr(comp): ParseReg Unmatched () (pos 78)
03/09/05 11:50:52:734 -- (2976) Found Keywords: [naakte meisjes]
03/09/05 11:50:52:734 -- (2976) EMail from mailto:Tania.DeBuck@viasoc.be - Tania.DeBuck@viasoc.be to mailto:koenraad@khd.be - koenraad@khd.be matches content filter rules - rejected.
03/09/05 11:50:52:936 -- (2976) EMail from mailto:Tania.DeBuck@viasoc.be - Tania.DeBuck@viasoc.be to mailto:koenraad@khd.be - koenraad@khd.be was received and quarantined. Size: 9 KB, 9216 bytes
03/09/05 11:50:52:936 -- (2976) Disconnect
03/09/05 11:50:53:014 -- (4056) Connection from: 195.238.3.234  -  Originating country : Belgium
03/09/05 11:50:53:201 -- (4056) Resolving 195.238.3.234 - outmx007.isp.belgacom.be
03/09/05 11:50:53:279 -- (4056) isp.belgacom.be is a domain, searching for SPF record
03/09/05 11:50:53:295 -- (4056) - SPF analysis for isp.belgacom.be done: - none
03/09/05 11:50:53:295 -- (4056) Mail from:
03/09/05 11:50:53:981 -- (4056) - MAPS search done...
03/09/05 11:50:53:981 -- (4056) RCPT TO: mailto:Tania.DeBuck@viasoc.be - Tania.DeBuck@viasoc.be accepted
03/09/05 11:50:54:449 -- (4056) String matching error for (from 195.238.3.234 by  (logsat software smtp server) wed, 9 mar 2005 11:50:54 +0100 from localhost (localhost) by outmx007.isp.belgacom.be (8.12.11/8.12.11/skynet-out-2.22) id j29aqgjs008215; wed, 9 mar 2005 11:52:44 +0100 (envelope-from <mailer-daemon>)  --and-- (valtrex|zyrtec|\bhgh\b|ambien\b|flonase|allegra|didrex|reno va\b|bontril|nexium)[\w\-_.]*\.[a-z]{2,}     # Fourth drug super regexp) : TRegExpr(comp): ParseReg Unmatched () (pos 78)
03/09/05 11:50:55:540 -- (4056) Found Keywords: [naakte meisjes]
03/09/05 11:50:55:556 -- (4056) EMail from  to mailto:Tania.DeBuck@viasoc.be - Tania.DeBuck@viasoc.be matches content filter rules - rejected.
03/09/05 11:50:55:758 -- (4056) EMail from  to mailto:Tania.DeBuck@viasoc.be - Tania.DeBuck@viasoc.be was received and quarantined. Size: 12 KB, 12288 bytes
03/09/05 11:50:55:758 -- (4056) Disconnect

looks like there is an error in your regex:

TRegExpr(comp): ParseReg Unmatched ()

Koenraad,

To add to what Mikek correctly pointed out, it also appears that you are using comments -- "# Fourth drug super regexp" -- in your expressions.  Comments are not allowed in LogSat's RegExp implementation at the present time.  http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=3683 - See this article for more information.

You stated that SpamFilter is not sending the "557 This email is rejected" response.  Roberto will need to respond to this specific issue -- but it would still be a good idea to remove the comments and make sure that the RegExp is functioning properly.  If your RegEx syntax is correct, you should not be seeing "String matching error" messages in your log file.

Jim