question about logging ...

[Denis Beauchemin]

Uwe,

If you look at the line:

> > myserver MailScanner[6012]: Message h8T9DHO07099 from xxx.xxx.x.xx
> > (rsvp at blinddatefun.com) to  MYDOMAIN is spam, SpamAssassin
> > (score=27.133, required 5, BAYES_99 5.40, BLANK_LINES_70_80 2.13, 
> > CLICK_BELOW 0.10, DATE_IN_FUTURE_06_12 1.97, DCC_CHECK 2.91,
> > FAKE_HELO_HOTMAIL 1.50,  FORGED_HOTMAIL_RCVD 0.50,
> > INVALID_DATE_TZ_ABSURD 1.78, MSGID_OUTLOOK_INVALID 4.10,
> > MSGID_SPAM_ZEROES  4.10, RAZOR2_CF_RANGE_51_100 1.10, RAZOR2_CHECK
> > 1.05, REMOVE_PAGE 0.50)

You get the message ID (in this case it is h8T9DHO07099) that you can
grep in your log file to find the sender and destination.

Denis
-- 
Denis Beauchemin, analyste
Université de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045