Duplicate Log entries?

[Julian Field]

Remember that when MailScanner finds a virus in a message, it has to rescan
it in an attempt to disinfect it. So messages with viruses in them will be
scanned more than once. There's no way out of that, unfortunately.

At 21:49 28/05/2002, you wrote:
>Hmmm,
>
>having a rummage round my logs whilst I upgrade to
>the latest release,  I notice that MailScanner appears
>to scan mails twice,  heres an extract:
>
>May 28 21:42:51 quicksilver.ukc.ac.uk mailscanner[27921]: Scanning 7
>messages, 1113616 bytes
>May 28 21:42:53 quicksilver.ukc.ac.uk mailscanner[27921]: >>> Virus
>'W32/Klez-H' found in file ./17Cnnb-0001PL-00/install.exe
>May 28 21:42:53 quicksilver.ukc.ac.uk mailscanner[27921]: Executable
>program file in install.exe
>May 28 21:42:53 quicksilver.ukc.ac.uk mailscanner[27921]: Found 2 viruses
>in messages 17Cnnb-0001PL-00
>May 28 21:42:53 quicksilver.ukc.ac.uk mailscanner[27921]: Scanned 7
>messages, 1113616 bytes in 2 seconds
>May 28 21:42:54 quicksilver.ukc.ac.uk mailscanner[27921]: Notified senders
>about 1 infections
>May 28 21:42:56 quicksilver.ukc.ac.uk mailscanner[27921]: Commercial
>disinfector sophos returned 768
>May 28 21:42:57 quicksilver.ukc.ac.uk mailscanner[27921]: >>> Virus
>'W32/Klez-H' found in file ./17Cnnb-0001PL-00/install.exe
>May 28 21:42:57 quicksilver.ukc.ac.uk mailscanner[27921]: Executable
>program file in install.exe
>May 28 21:42:57 quicksilver.ukc.ac.uk mailscanner[27921]: Found 2 viruses
>in messages 17Cnnb-0001PL-00
>
>
>This is confirmed by the message id matching up on both occassions.  I admin
>it seems a tad odd and could well be playing havoc with my stats.
>
>Thoughts, comments - are as always welcome.
>
>Cheers
>
>Paul

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ