Jonas and all , Grep'ing through the logs manually, I see a virus called "<Anonymous". Not sure if it was some kind of anomaly with uvscan, or Mimedefang, or if there really was some virus known as <Anonymous, but is it possible Graphdefang is having trouble processing VirusName with garbage like < as value1? If it is, do you know a way to remove this data from SummaryDB.db?
I'm otherwise stumped. Thanks, Joe Arnstein -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Arnstein Sent: Monday, May 17, 2004 12:09 PM To: [EMAIL PROTECTED] Subject: RE: [Mimedefang] Graphdefang not graphing virus types Hi Jonas, Thanks for your response. The default 'general' file I'm using matches up with what my log files look like, and SummaryDB.db contains virus-type information, indicating that it is collecting that data....not sure if it's saved as 'value1' or not. The logs that incorporate value2 are accurate, but there is only one value1 graph which of course didn't work. Here is a snip from my log: May 17 11:58:40 mailserver1 mimedefang.pl[5603]: MDLOG,i4HG1s5B024434,virus,W32/[EMAIL PROTECTED],68.41.153.55,<[EMAIL PROTECTED] om>,<[EMAIL PROTECTED]>,Mail Delivery (failure [EMAIL PROTECTED]) if ($text =~ m/^MDLOG,\S+?,(\S+?),(\S*?),(\S*?),(.*?),(.*?),(.*)$/ ) $event = $1; $value1 = $2; $value2 = $3; $sender = $4; $recipient = $5; $subject = $6; $FoundNewRow = 1; Value1 should be W32/[EMAIL PROTECTED], no? Joe -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jonas Eckerman Sent: Friday, May 14, 2004 5:09 PM To: [EMAIL PROTECTED] Subject: Re: [Mimedefang] Graphdefang not graphing virus types On Fri, 14 May 2004 10:54:43 -0400, Joe Arnstein wrote: > senders of viruses show up OK, but Graphdefang generates an empty > .png file for the list of virus types (daily/hourly/monthly Check your mimedefang event file (usually "event/mimedefang.pl/general" i graphdefang's dir) and compare it's regexp matching to the log lines. Do you get correct value1-data for other events? /Jonas -- Jonas Eckerman, [EMAIL PROTECTED] http://www.fsdb.org/ _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
