You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Horne <jo...@plymouth.ac.uk> on 2010/10/04 23:55:13 UTC
Re: New plugin: DecodeShortURLs
On Thu, 2010-09-23 at 11:30 +0100, Steve Freegard wrote:
> >
> > Hopefully it will be useful to others; you can grab it from:
> >
> > http://www.fsl.com/support/DecodeShortURLs.pm
> > http://www.fsl.com/support/DecodeShortURLs.cf
> >
>
...
>
> - Added option to allow logging to syslog (mail.info).
>
Hello,
I grabbed a copy of the above plugin and tried it this afternoon (on a
CentOS 5.5 system). We log all our spamd messages to /var/log/maillog
via syslog. For the plugin I disabled all the options except
'url_shortener_syslog' which was set to 1.
After restarting SpamAssassin we started to get some messages from spamd
sent to /var/log/mailog and some sent to /var/log/messages. Not messages
from the plugin, but any messages from spamd. For example
(from /var/log/messages):
Oct 4 22:28:50 pat sauser[31061]: spamd: checking message
<79...@www.facebook.com> for sauser:10001
Oct 4 22:28:56 pat sauser[31061]: spamd: clean message (-0.1/8.0)
for sauser:10001 in 5.6 seconds, 7896 bytes.
Oct 4 22:28:56 pat sauser[31061]: spamd: result: . 0 -
BAYES_00,DCC_CHECK,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,
HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS
scantime=5.6,size=7896,user=sauser,uid=10001,required_score=8.0,
rhost=localhost.localdomain,raddr=127.0.0.1,rport=38700,
mid=<79...@www.facebook.com>,
bayes=0.000000,autolearn=no
The messages are not just being duplicated in both files, there are
different messages in each file. Our syslog.conf specifies:
*.info;mail.none /var/log/messages
mail.* -/var/log/maillog
I tried changing DecodeShortURLs.pm calls to syslog to use 'info|mail'
and that made no difference. I also tried commenting out the 'syslog'
calls, and used backtick calls to '/usr/bin/logger' instead. The same
problem happened. If I take the plugin out, then all messages from spamd
go to /var/log/maillog as before.
Anyone any ideas as to what is going on?
Thanks,
John.
--
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287 Fax: +44 (0)1752 587001
Re: New plugin: DecodeShortURLs
Posted by John Horne <jo...@plymouth.ac.uk>.
On Mon, 2010-10-04 at 22:55 +0100, John Horne wrote:
>
> I grabbed a copy of the above plugin and tried it this afternoon (on a
> CentOS 5.5 system). We log all our spamd messages to /var/log/maillog
> via syslog. For the plugin I disabled all the options except
> 'url_shortener_syslog' which was set to 1.
>
> After restarting SpamAssassin we started to get some messages from spamd
> sent to /var/log/mailog and some sent to /var/log/messages.
>
Hello,
Well I suspect the problem is with the Sys::Syslog perl module. On our
CentOS 5.5 system we have perl 5.8 with version 0.13 of the module (this
is quite old). My Fedora 13 PC uses perl 5.10 with version 0.27 of the
module (the latest version). However, it seems there is a bug with that
version which causes it to ignore the facility - (fix here)
http://rt.cpan.org/Public/Bug/Display.html?id=55151
I have left the plugin enabled, but without using the syslog options.
I have had a look at the (0.13) syslog module, but can't really see
where the problem is. If I get more time, then I may try and debug it
further.
John.
--
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287 Fax: +44 (0)1752 587001
Re: New plugin: DecodeShortURLs
Posted by Jason Bertoch <ja...@i6ix.com>.
On 2010/10/04 6:35 PM, Martin Gregorie wrote:
> Just a data point for you.
>
> I'm running DecodeShortURLs with the as-issued .cf file
> (log,cache,syslog options commented out).
I initially tried running the plugin with these options commented out,
but it just doesn't work. It needs those defined. Once I uncommented,
everything began working beautifully.
--
/Jason
Re: New plugin: DecodeShortURLs
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2010-10-04 at 22:55 +0100, John Horne wrote:
> I grabbed a copy of the [DecodeShortURLs] plugin and tried it this afternoon (on a
> CentOS 5.5 system). We log all our spamd messages to /var/log/maillog
> via syslog. For the plugin I disabled all the options except
> 'url_shortener_syslog' which was set to 1.
>
Just a data point for you.
I'm running DecodeShortURLs with the as-issued .cf file
(log,cache,syslog options commented out). It has found a couple of
shortened URLs too, but all its log messages have been sent
to /var/log/maillog. None were sent to /var/log/messages.
Martin