Forum Discussion
What_Lies_Bene1
Cirrostratus
Sep 10, 2013The rule looks OK to me. Have you checked that the Content-Type header is present? Do you get any log messages? You could also add 'log local0. "No Header Match"' just before the last } of the HTTP_RESPONSE event (on it's own line) to confirm if there is no header/match.