Bug 38915

Summary:	Spam statistics fail due to outdated logging template of amavis
Product:	UCS	Reporter:	Michael Grandjean <grandjean>
Component:	Mail	Assignee:	Daniel Tröder <troeder>
Status:	CLOSED FIXED	QA Contact:	Felix Botner <botner>
Severity:	minor
Priority:	P5	CC:	birkefeld, gohmann, schwardt, walkenhorst
Version:	UCS 4.0	Flags:	grandjean: Patch_Available+
Target Milestone:	UCS 4.0-3-errata
Hardware:	Other
OS:	Linux
What kind of report is it?:	---	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:
Attachments:	svn diff of patch proposal. removes $log_templ and adds UCRV mail/amavis/debug/level

Description Michael Grandjean

2015-07-13 21:27:33 CEST

Created attachment 7023 [details]
svn diff of patch proposal. removes $log_templ and adds UCRV mail/amavis/debug/level

Popular statistic tools like amavis-logwatch fail, because they expect certain keywords in the log messages of amavis.

univention-antivir-mail provides a configuration file for amavisd-new (60-univention) that specifies a log template:

> # log both infected and noninfected messages (default):
> $log_templ = '[? %#V |[? %#F |[?%#D|Not-Delivered|Passed]|BANNED name/type (%F)]|INFECTED (%V)], #
> [?%o|(?)|<%o>] -> [<%R>|,][? %i ||, quarantine %i], Message-ID: %m, Hits: %c';

The problem is, that this overwrites the built-in log template. By now, amavis (at least the debian package) has a reasonable built-in log template that has evolved with recent releases, works well with amavis-logwatch and should fit our needs. Since I can't find a dependency on our custom log template, I recommend to simply remove it and rely on the built-in one.

Additionally, it would be great if the amavis log level would be configurable via UCR.

I'll attach a patch proposal.

Comment 1 Daniel Tröder

2015-09-01 15:38:48 CEST

Thank you for the patch.

Commit 63378 configures amavis to using the default logging template and adds a UCR variable mail/antivir/amavis/debug/level to set amavis log level (default=0).

Much of the really interesting data (like scan timing) is available when Amavis' $log_level is set to at least 2.

YAML (r63379): 2015-09-01-univention-antivir-mail.yaml

Comment 2 Felix Botner

2015-09-03 18:57:18 CEST

FAIL - please merge to 4.1-0

OK - log_templ is no longer defined in /etc/amavis/conf.d/60-univention

new - Passed SPAM {RelayedTaggedInternal}, LOCAL [192.168.0.68]:37529 [192.168.0.68] <fbotner@vitsig.knut.univention.de> -> <test1@four.test>, Queue-ID: 6CEF71BFCB0, mail_id: yqP0xUx4s_9B, Hits: 999.13, size: 487, queued_as: A29741C0253, 240 ms

old - Passed, <fbotner@vitsig.knut.univention.de> -> <test1@four.test>, quarantine EhutQKL5QYsQ, Message-ID: , Hits: 999.13

OK - mail/antivir/amavis/debug/level

OK - YAML

Comment 3 Daniel Tröder

2015-09-04 09:36:17 CEST

Merge to 4.1: r63458

Comment 4 Felix Botner

2015-09-04 13:53:25 CEST

OK

Comment 5 Janek Walkenhorst

2015-09-09 12:51:24 CEST

<http://errata.software-univention.de/ucs/4.0/305.html>