Sys::Syslog Bug Report

[JWSmythe]

        Julian,

        Last night at about 5am, our mail server stopped delivering mail.
Everything was being stored in my mqueue.in , but not being processed further.

        Every time mailscanner started, this error would pop up in my logs, and
on console.

Aug 23 13:45:05 mail mailscanner[8807]: Commercial virus checker failed
with real error: Modification of a read-only value attempted at
/usr/lib/perl5/5.8.0/i686-linux/Sys/Syslog.pm line 296, <KID> line 2.

        We had about 2900 messages in mqueue.in/ , and reading through the list
real quick, I noted someone had opted to delete their mqueue.in to fix the
problem.  That would probably have not been an acceptable choice.

        I modified logger.pl to print a line for every Sys::Syslog line, so I
could se what it was trying to do on the console..  Here's what I ended up
seeing:

Printing Debug to Sys::Syslog, SpamAssassin returned 0
Printing Debug to Sys::Syslog, Going to scan 100 messages
Printing Debug to Sys::Syslog, Commencing scanning by mcafee...
Printing Info to Sys::Syslog /g7N98C2j022911/%nTips.pif        Found the
W32/Klez.h at MM virus !!!
Printing Debug to Sys::Syslog, Completed scanning by mcafee
Printing to Sys::Syslog Commercial virus checker failed with real error:
Modification of a read-only value attempted at
/usr/lib/perl5/5.8.0/i686-linux/Sys/Syslog.pm line 296, <KID> line 2.
Closing Sys::Syslog (2)

        It seems when sub InfoLog tries to print the "%n", that bombs it out.  I
didn't want to go molesting your code any more than I needed to, so I just went
into that message's file(dfg7N98C2j022911), and changed this block:

--- begin
Content-Type: application/octet-stream;
        name=%nTips.pif
Content-Transfer-Encoding: base64
Content-ID: <L3kHd9QbKZ9H1vv62R>
--- end

To this:

--- begin
Content-Type: application/octet-stream;
        name=Tips.pif
Content-Transfer-Encoding: base64
Content-ID: <L3kHd9QbKZ9H1vv62R>
--- end


        When I restarted mailscanner this time, it went through fine.
Unfortunately, we were up to 3400 messages in the queue at that point.  Now
we're down to 2900, so it's getting through, but my users are upset they didn't
get their mail all day..  They'll live. :)

        If you need, I can give you the message files to work with, but it's
just something in how Sys::Syslog is handling the '%' character.


        BTW, I'm running Perl 5.8.0 and MailScanner 3.22-12