1

We have a monitoring system that sends out alerts whenever one of its trigger conditions is met to a mailing list I am on . Most of these messages are garbage to me, so I set up a rule to filter out all the noise. However, this rule is not working properly.

Here are the rule conditions:

from Sysmon
  and sent to IT Alerts
  and with 'is Up' or 'is Down' in the subject
move it to the Alerts folder
except if the subject contains <list of systems I care about>
stop processing more rules

I have many messages sitting in my inbox that should meet this rule, but they're not being moved to my Alerts folder, even when I run the rule manually.

I suspect the reason is because Sysmon is a Linux appliance using a non-Exchange client to send out the alerts. When I try to modify the From field of the rule, Outlook resolves Sysmon to an actual mailbox (which it is), but the message comes from sysmon@mycompany.com rather than just Sysmon (the internal mailbox name), and I can't get the rule to not resolve the name to the mailbox.

If I remove the From condition, the rule works fine. However, I don't want to do that, because my colleagues will sometimes reply to that message and put something like "I'm working on this" in the body, and I want to see those messages.

Is there any way to get this rule to work? I'm using Outlook 2016 if that matters, and our Exchange server is internal (no Office 365 or Exchange cloud stuff).

1

I suspect the reason is because Sysmon is a Linux appliance using a non-Exchange client to send out the alerts. When I try to modify the From field of the rule, Outlook resolves Sysmon to an actual mailbox (which it is), but the message comes from sysmon@mycompany.com rather than just Sysmon (the internal mailbox name), and I can't get the rule to not resolve the name to the mailbox

Maybe you can try changing the 'from Sysmon' condition to 'with specific words in the sender's address'.

  • Makes me wonder why I didn't think of that :-) I think it's because there are so many rule conditions you can choose that it becomes noise at that point and you wind up not reading them carefully. – Wes Sayeed Jan 17 '18 at 17:38
1

I ran into the same issue and confirm using 'with specific words in the sender's address' as a possible solution. Alternatively, you can also use with specific words in the message header.

In either case you might want to check the internet headers to be sure of the text string to match.

Email headers are found here:
Open mail message in a new window > File > Properties > Internet headers
(Tip: you can click on the headers box to copy and paste to a text editor)

View internet message headers

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.