I must either be syslog-ng or the Perl Syslog module. MailScanner uses
it as expected, I don't do anything odd.
Someone else has just reported this problem, and yet no-one has seen it
before, makes me suspicious of syslog-ng if that has just been upgraded.
Gabor FUNK wrote:
Same happens with syslog-ng/mailscanner.
Very small part of just one line for example:
2006-04-11 23:55:47 ns1 MailScanner[26405]: MailScanner E-Mail Virus
Scanner version 4.51.5 starting...<22>Apr 11 23:55:48
MailScanner[26405]: I have found f-prot clamav mcafee scanners
installed, and will use them all by default.<22>Apr 11 23:55:48
MailScanner[26405]: ClamAV scanner using unrar command
/usr/bin/unrar<22>Apr 11 23:55:48 MailScanner[26405]: Using locktype =
posix<22>Apr 11 23:55:48 MailScanner[26405]: Creating hardcoded
struct_flock subroutine for linux (Linux-type)<22>Apr 11 23:55:54
MailScanner[26405]: New Batch: Scanning 14 messages, 2258398
bytes<22>Apr 11 23:55:54 MailScanner[26405]: Expanding TNEF archive at
/var/spool/MailScanner/incoming/26405/1FTQCD-0000rd-NG/winmail.dat<22>Apr
11 23:55:54 MailScanner[26405]: Message 1FTQCD-0000rd-NG added TNEF
contents msg-26405-11.txt,msg-26405-21.msg,msg-26405-31.txt,HTPlus
e171.pdf<22>Apr 11 23:55:54 MailScanner[26405]: Message
1FTQCD-0000rd-NG has had TNEF winmail.dat removed<22>Apr 11 23:55:54
MailScanner[26405]: Virus and Content Scanning: Starting<22>Apr 11
23:55:58 MailScanner[26405]: Filename Checks: Allowing
1FTQCD-0000rd-NG msg-26405-1.txt (no rule matched)<22>Apr 11 23:55:58
MailScanner[26405]: Filename Checks: Allowing 1FTQCD-0000rd-NG
msg-26405-2.msg (no rule matched)<22>Apr 11 23:55:58
MailScanner[26405]: Filename Checks: Allowing 1FTQCD-0000rd-NG
msg-26405-3.txt (no rule matched)<22>Apr 11 23:55:58....
<22> --> mail.info
(Some more examples here: http://www.huweb.hu/v/ms/mail.info )
Furthermore it seems that 1st part of the "line" starts normally, eg.:
2006-04-11 23:55:47 ns1 MailScanner[26405]:
while subsequent lines "lose" date format and host name...
Apr 11 23:55:48 MailScanner[26405]:
Don't know whether it is syslog-ng's, mailscanner's or perl's fault
but I'd like to have it fixed :-)
Obviously we can't fix the RFC if that would be the bad one :-]
Cheers, G.
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
