Philip Hazel <ph10@???> wrote:
> On Mon, 10 Jan 2005, Michael F. Sprague wrote:
>
> > "If the log_message modifier is set when discard operates, its contents are
> > added to the line that is automatically written to the log."
> >
> > Yet this does not seem to be true and I found several references in the list
> > archives. There is a workaround by using a warn before the discard so it's
> > not a major issue, I'm just curious if I'm reading the docs wrong or not.
>
> I've now looked at this. It turns out that there is a test in my test
> suite that checks this feature, and "it works for me". Therefore, you
> must be doing something differently to my straightforward test. Please
> send me the configuration that you are using when this does not work,
> and the logging output that it provokes.
Sorry for the delay.
Here is what I want to have in my data acl:
discard
condition = ${if <{$message_size}{2048}{true}{false}}
malware = *
log_message = VIRUS ($malware_name) RCPT=$acl_m9 SUB=${quote:$h_subject:} \
MSGID=$h_message-id:
With the above I get this in the log:
2005-01-10 12:03:32 1Co2wv-00023u-K7 => blackhole (DATA ACL discarded recipients)
The stuff I put in log_message doesn't come out. So I do this instead:
warn
condition = ${if <{$message_size}{2048}{true}{false}}
malware = *
log_message = VIRUS ($malware_name) RCPT=$acl_m9 SUB=${quote:$h_subject:} \
MSGID=$h_message-id:
discard
condition = ${if <{$message_size}{2048}{true}{false}}
malware = *
and now I get:
2005-01-10 12:18:18 1Co3BD-00024S-Br VIRUS (Trojan.Spy.Goldun.Gen-pack) RCPT=msprague@??? SUB="" MSGID=
2005-01-10 12:18:18 1Co3BD-00024S-Br => blackhole (DATA ACL discarded recipients)
I still wish to do more testing on this but I got swamped with another task
and I was able to get a work around pretty easily. If I discover anything else
I'll let you know.
thanks,
mikeS
--
Michael Sprague | mfs@???
Partner | System and Network Engineering (SaNE), LLC
use STD::disclaimer;