Finn Buhelt wrote:
Hi Eric.
I have checked clamav-toaster-0.95.3.1.3.31 : logtime set to
default NO
clamav-toaster-0.96.0.1.3 : logtime set
to YES (faulty)
clamav-toaster-0-96.1.1.3.36 : logtime set to
YES (faulty)
This indicates a change in the freshclam.conf file when moving from
version 0.95 to 0.96 - there are also other changes in the conf file.
There seems to be new directives from ver. 0.96 - all are at the end of
the conf file (statistics, google browsing etc) but they are all
disabled and has nothing to do with the logtime directive, but maybe the
logtime change has sneaked in when adding these new features.
I think that everyone that installs from scratch and all that uses
qtp-update gets the faulty logtime setting (I think qtp-update
overwrites the current freshclam.conf when put into production).
No, qtp-newmodel (not qtp-update) follows whatever rules are in the spec
file for configs.
Only if You 'manually' rpm updates You 'only' get the faulty setting in
the freshclam.conf.rpmnew file - this ofcourse only if the logtime
setting was disabled in the freshclam.conf file You are updating.
That's because the freshclam.conf file is now coded as 'noreplace' in
the spec file, which is correct (imho). I don't believe this was always
the case, as I have 2 freshclam.conf.rpmsave files (dated Jan and Apr
this year), which indicate that 'noreplace' was added fairly recently.
BTW, both rpmsave files have LogTime commented out.
So here's what I think. 0.96.0 introduced "LogTime Yes", and did not
have noreplace in the spec file, so anyone upgrading/installing 0.96.0
got the new setting. Then 0.96.1 came out, again with "LogTime Yes", but
the config was changed to "noreplace". So anyone upgrading from a
version previous to 0.96.0 to version 0.96.1 is ok, but anyone who had
0.96.0 installed in any way (new or upgraded) has "LogTime Yes".
But why, may we ask, is the logtime directive in there at all ? It is
not documented anywhere as being a valid setting in the freshclam.conf
file !
It's documented in the config file. ;) Sometimes the man pages aren't
kept up to date, or things get missed in the documentation, especially
on a .0 release.
IMHO, a log file w/out time stamps on every line are deficient. I really
like the option. However, the time format should be consistent with the
syslog format (which it is not).
I believe the best remedy for this problem is to fix logwatch to deal
appropriately with the timestamp in the log. The fix I referred to
yesterday does appear to work fine. The fix isn't very robust though, as
the format of the timestamp is not flexible at all. That's a fault in
logwatch though, not clamav.
BTW You are not loosing it - I think many would have lost their minds
having all these threads going on in this forum as You have - I know
everyone in here appreciates the huge effort You put into responding to
all our 'challenges' - so keep up the good work - You are not allowed
to loose anything ;-)
Ha! Thanks.
Thanx,
Finn
----- Original Message ----- From: "Eric Shubert" <[email protected]>
To: <[email protected]>
Sent: Saturday, June 19, 2010 1:45 AM
Subject: [qmailtoaster] Re: freshclam & logwatch
Finn Buhelt wrote:
Hi Eric.
Now I've done some research regarding the logtime 'feature'.
According to documentation there is no 'logtime directive' in a
freshclam.conf file - even looking through some of the sourcecode
(freshclam) I cannot find anything that deals with such a directive -
well okay it's been many years since I did code so I may absolutely
have missed something.
But I did check/unpack latest clamav-toaster-0.96.1.1.3.36.rpm and
found that the logtime is set to YES in the freshclam.conf file -
which matches perfectly with my own latest freshclam.conf.rpmnew
(etc/freshclam.conf.rpmnew) file that has the YES setting.
I think the YES setting may have been introduced when
clamav-toaster-0.96.0* was made, because it was that time I had the
issue at first (back in April) - I also recall that I used the
QTP-MENU update - and had some issues switching to production (I made
some notes but have lost them) .
Doing some checking in the clamav.org site and checking the latest
source from here, the setting in the freshclam.conf is NO.
when I get some time I will try to find the rpm's from then and
unpack to verify.
Cheers,
Finn
Thanks Finn.
FWIW, my freshclam.conf.rpmnew from the latest (0.96.1) update also
has "LogTime Yes", so at least that's consistent (and I'm not losing
my mind - yet).
--
-Eric 'shubes'
---------------------------------------------------------------------------------
--
-Eric 'shubes'
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
