speed kills of course -- In my immediate prior post, I reversed the match and the anchor operators. ^ *List-Id:.*centos\.centos\.org ^ *Subject:.*CentOS Based Linux Firewall Document should have been * ^List-Id:.*centos\.centos\.org * ^Subject:.*CentOS Based Linux Firewall Document of course. Fortunately, in my local setup I had set content to be dropped to be saved to a file while I tested. -- Russ Herrold