notice help

[James Gray]

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tue, 16 Nov 2004 12:57 pm, Jorge A. Arenas Quezada wrote:
> Hi everyone:
>
>     I like to know if there is a way to send notice about virus to the
> administrator, but only from mails from inside address.
>
>     I have problems because i receive 300 notice mails, but i like to make
> some separation from virus from inside computers and virus received from
> the rest of the world.
>
>     i like to point my view to internal addresses with problems, not to
> all 300 mails.
>
> it's possible to do this ?
>
> thanks
>
> jorge arenas

Simple answer: ruleset

Find the bit in MailScanner.conf that says:

# Notify the local system administrators ("Notices To") when any infections
# are found?
# This can also be the filename of a ruleset.
Send Notices = yes

Change to "Send Notices = %rules-dir%/notices.rules"

"%rules-dir%" is usually /opt/MailScanner/etc/rules - or check where it points
at the top of MailScanner.conf.  Anyway, in %rules-dir% create the file
"notices.rules" with the following:

From:         1.2.3.4       yes
From:         1.2.3.5    yes
ToOrFrom:     default    no

where those IP addresses reflect your internal networks.  Then restart
mailscanner.  Voila.  For further info, read the MAQ and archives about
rulesets (links at th bottom of every post on this list).

Cheers

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!