Tar off the latest procmail. www.procmail.org Watch permissions from /opt on down (/export/home/USER, and all the dot file in the home dir too). Needed files in homedir: ------------------------------------------------------------------ -rw------- 1 user unix 91 Apr 23 12:55 .forward drwx------ 3 user unix 512 Apr 23 12:39 .mailspool -rw-r----- 1 user unix 1616 Apr 23 13:07 .procmailrc If you want to exclude email (grep -v) :0w <- the 'w' is it | /some/dir/file /some/dir/file ------------------------ MSG="phrase in email you want to delete and not process" # look at stdin and see if pattern is there if [[ -n $(grep $MSG $*) ]] then #exit 0 tells procmail to NOT take any more action with message else #exit 1 tells procmail to handle message as normal exit 1 fi ------------------------ ------------------------------------------------------------------ $ more .forward "|IFS=' ' && p=/usr/local/bin/procmail && test -f $p && exec $p -Yf- || exit 75 ------------------------------------------------------------------ $ more .procmailrc PATH=/usr/bin:/usr/local/bin SHELL=/bin/ksh VERBOSE=on PMDIR=$HOME LOGFILE=$PMDIR/procmaillog #MAILDIR=$HOME/.mailspool #DEFAULT=$HOME/.mailspool/mbox #LASTFOLDER=$HOME/.mailspool/mbox ## Select to excute based User that sent it: :0 h * ^From.someuser.somedomain.com * ^Subject: FW:.* { :0 | /opt/mail/smtp/AutoAlias.wrap \ `egrep "Subject: FW:" | awk '{print $3}'` someuser } :0 h * ^From. /dev/null ## the users who email the now-defunct jobs@computeranddata.com :0h * ^To.*jobs@computeranddata.com { :0 | (formail -r; cat .procmail/jobs_email.txt) | /usr/lib/sendmail -oi -t }