Logwatch file being tagged as a virus file and deleted

[Mark Sapiro]

Howard Fleming wrote:

>Is there any way to exclude a email address from being scanned for 
>viruses?  For the last 3 days my logwatch file from my mail server has 
>been deleted, and I get the following:
>
>     Sender: root at messenger.mideasti.org
>IP Address: 127.0.0.1
>  Recipient: hfleming at mideasti.org
>    Subject: LogWatch for messenger.mideasti.org
>  MessageID: F254D540E8.78B90
>Quarantine:
>     Report: Clamd:  message was infected: Email.Phishing.DblDom-39 FOUND
>
>I have added root at messenger.mideasti.org to phishing.safe.sites.conf, 
>but it did not make any difference (or is this the right place?).


I had the same issue when I first installed Mailscanner. My solution is
to put

Scan Messages = %rules-dir%/scan.messages.rules

in MailScanner.conf and then put

From: 127.0.0.1 no
FromOrTo: default yes

in scan.messages.rules. You may not want to exempt all mail originating
from localhost, so you may want a more restrictive rule.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan