On 03/02/2011 10:15 AM, Clayton Keller wrote: > On 02/24/2011 10:08 AM, Clayton Keller wrote: >> I have been struggling with handling some pesky encoded characters in >> mail logs as of late. >> >> My issue involves passing the message on to a remote rsyslog server >> which then processes the messages into a database. From time to time I >> see messages with something similar to the following: >> >> "Subject:<RE: VIAGRA \256 Official Site ID031831740>" >> >> In my case, messages are passed to processing mechanisms via triggers >> prior to a final insertion but I am getting DB errors based on the >> handling of these "invalid" characters. >> >> I don't think the use of mime2utf8 will help me in these types of >> instances. Also, after looking through previous mailing list messages >> I've seen references to somewhat similar types of issues with the use of >> setting the LANG= value with the invocation of amavisd-new. I may be not >> thinking this through clearly, but I don't think that would help much in >> this case since everything is happening after the fact on a completely >> different system. >> >> Would I be better off in the log template doing some type of find and >> replace regex on the fields to help escape these characters? Is that >> even possible? Typically I'd do this in the code that is called by the >> trigger but I'm not quite getting that far along in the processing yet >> to do that. My thinking at this point is to escape any backslashes >> before I write the log and then hopefully I can handle the escaped >> characters elsewhere. >> >> I see the following noted in the README.customize file: >> >> "If assigning to variables, care must be taken to properly quote certain >> special characters (like backslash), as required by Perl quoting rules. >> Text read from amavisd file or from external files is not subject >> to Perl quoting rules." >> >> But what is the best practice to do so within the templates and the >> available macros? Or is it more raw perl within the template that I need >> to consider? >> >> My apologies if this is a bit off-topic for the list but any ideas would >> be appreciated. >> >> Clay >> > > After additional troubleshooting and trial and error of my issue, it is > looking more like I need to take a more simple approach of a find and > replace mentality to the content passed to amavisd-new. > > Looking through README.customize I don't see any predefined macros which > do such a thing thus far, and am considering a custom macro to do just this. > > I wanted to throw this out to the list to make sure I'm not overlooking > something obvious or already available. > > Clay >
My apologies as this is starting to stray off-topic a bit and that I keep replying to my own thread asking more questions. But, given the example from my original email, am I thinking correctly that the subject with it's ascii representation of the "registered sign" not fall under RFC 2822 specifications for an unstructured header field using US-ASCII? Shouldn't this then have been MIME encoded to meet specifications? I'm not sure it's safe to discard these messages. Although I am going to look through those that are showing this type of behavior and determine how many may be legitimate messages. Any thoughts or comments from the list would be appreciated. ------------------------------------------------------------------------------ Free Software Download: Index, Search & Analyze Logs and other IT data in Real-Time with Splunk. Collect, index and harness all the fast moving IT data generated by your applications, servers and devices whether physical, virtual or in the cloud. Deliver compliance at lower cost and gain new business insights. http://p.sf.net/sfu/splunk-dev2dev _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user Please visit http://www.ijs.si/software/amavisd/ regularly For administrativa requests please send email to rainer at openantivirus dot org
