spam mail message collector

(I added mailing list addresss to recipient.)
I found ‘set_contents_file() in connection_established event’ does what I want.

But it doesn’t work for uni-direction packets. Any option for this?

And if I use -b option (bare mode) for performance, connection_established is called much less. I thought only difference in bare mode was using less protocol parser…