Hi Benny, Does your amavis come from a distribution or package? The amavisd.conf in the source code does not include a log_templ. The amavisd.conf-sample does have an entirely commented out log_templ, and the amavisd.conf-default indicates:
# $log_templ = ... built-in default at the end of file amavisd Perhaps your distribution or packager combined the stock amavisd.conf and the sample configuration file. The amavis_logwatch utility works with the default built into amavis, which is (lines beginning with # are commented out): [?%#D|#|Passed # [? [:ccat|major] |OTHER|CLEAN|MTA-BLOCKED|OVERSIZED|BAD-HEADER|SPAMMY|SPAM|\ UNCHECKED|BANNED (%F)|INFECTED (%V)]# , [? %p ||%p ][?%a||[?%l||LOCAL ]\[%a\] ][?%e||\[%e\] ]%s -> [%D|,]# [? %q ||, quarantine: %q]# [? %Q ||, Queue-ID: %Q]# [? %m ||, Message-ID: %m]# [? %r ||, Resent-Message-ID: %r]# , mail_id: %i# , Hits: [:SCORE]# , size: %z# [~[:remote_mta_smtp_response]|["^$"]||[", queued_as: "]]\ [remote_mta_smtp_response|[~%x|["queued as ([0-9A-Z]+)$"]|["%1"]|["%0"]]|/]# #[? [:header_field|Subject] ||, Subject: [:dquote|[:header_field|Subject]]]# #[? [:header_field|From] ||, From: [:uquote|[:header_field|From]]]# #[? [:useragent|name] ||, [:useragent|name]: [:uquote|[:useragent|body]]]# #[? %#T ||, Tests: \[[%T|,]\]]# #[:supplementary_info|SCTYPE|, shortcircuit=%%s]# #[:supplementary_info|AUTOLEARN|, autolearn=%%s]# , %y ms# ] [?%#O|#|Blocked # [? [:ccat|major|blocking] |# OTHER|CLEAN|MTA-BLOCKED|OVERSIZED|BAD-HEADER|SPAMMY|SPAM|\ UNCHECKED|BANNED (%F)|INFECTED (%V)]# , [? %p ||%p ][?%a||[?%l||LOCAL ]\[%a\] ][?%e||\[%e\] ]%s -> [%O|,]# [? %q ||, quarantine: %q]# [? %Q ||, Queue-ID: %Q]# [? %m ||, Message-ID: %m]# [? %r ||, Resent-Message-ID: %r]# , mail_id: %i# , Hits: [:SCORE]# , size: %z# #, smtp_resp: [:smtp_response]# #[? [:header_field|Subject] ||, Subject: [:dquote|[:header_field|Subject]]]# #[? [:header_field|From] ||, From: [:uquote|[:header_field|From]]]# #[? [:useragent|name] ||, [:useragent|name]: [:uquote|[:useragent|body]]]# #[? %#T ||, Tests: \[[%T|,]\]]# #[:supplementary_info|SCTYPE|, shortcircuit=%%s]# #[:supplementary_info|AUTOLEARN|, autolearn=%%s]# , %y ms# ] MrC Benny Pedersen wrote: > On Fri, July 6, 2007 19:06, MrC wrote: > >> I use $log_level=2, and have for sometime. > > okay i have now tested with this aswell here > >>> and is default log_templ used ? >> amavis-logwatch matches against the default log_templ. > > default in amavisd perl and default in amavisd.conf dont match, i have used > the default from a old amavisd.conf > >> On my ToDo list is to support modifications to log_templ, but will require >> a significant amount of work; it also places additional requirements on >> the logwatch project. > > yes i can see the bennefit to just log whats are needed in amavisd-logwatch, > as it is now to much logged that in the end just go to dev-null > >> I may fork the project and implement log_templ formats, but I >> still need to investigate. > > okay > >>> amavisd-logwatch only shows sa tags when log level 3 is used, but this is >>> imho overkill :-) >> Yes, level 3 is quite verbose, and is not nessasary. Again, I use level >> 2. Check your syslog configuration as well. I have three simultaneous >> amavis logs, one at the default log level, and two at levels 2, one >> using syslog INFO and one DEBUG. > > problem here was not syslog, but amavisd logs diffrent then what is in > amavisd.conf for the log_templ > >>> if log_templ is defined in amavisd.conf the sa tags is shown in log level 0 >> log_templ is defined in the amavisd code itself - this is where the >> default log_templ comes from. Perhaps amavis is modified in your >> installation? > > nope, amavisd.conf have here commented $log_templ so the default from amavisd > is still used > >>> so my question is how to get the best results out of it ? >> Here are my settings in amavisd.conf >> >> $log_level = 2; # verbosity 0..5, -d >> $syslog_facility = 'local5'; # Syslog facility as a string >> >> and in syslog.conf: >> >> local5.notice -/var/log/amavisd.log >> local5.info -/var/log/amavisd-info.log >> local5.debug -/var/log/amavisd-debug.log >> >> >> At these settings, you should see lines in your logs such as: >> >> ... SPAM, <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>, Yes, score=7.196 tag=x >> tag2=6.2 kill=6.9 tests=[AWL=-1.862, BAYES_60=1, DKIM_POLICY_SIGNSOME=0, >> HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=2, >> RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=3, RDNS_DYNAMIC=0.1], >> autolearn=no, quarantine xxx(spam-quarantine) >> >> or SPAM-TAG lines when your tag level is low enough. Do you have such >> entries ? If not, perhaps show your various tag and quarantine related >> settings. > > yes i have now > >>> my testing olso change how Mailgraph works here, just will try to awoid it >> I'm not sure I understand what you mean here, in terms of relevance to >> the above? > > mailgraph olso use the default log_templ i hope, my concern is to not change > so it makes mailgraph not working when amavisd-logwatch does > > ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
