Syslogging broken

[Julian Field]

On 26/3/09 17:38, Scott Silva wrote:
> on 3-26-2009 2:44 AM Tom Weber spake the following:
>    
>> Am Donnerstag, den 26.03.2009, 09:08 +0000 schrieb Martin Hepworth:
>>      
>>> Tom
>>>
>>> from memory this was a problem with Greg's syslog.conf setup.
>>>        
>> Not afair. Greg also claimed that MailScanner suddenly started logging
>> as local3 not mail.
>> One may be able to work around this by redirecting local3 in syslog.conf
>> which is what he probably did.
>>
>> His Logs and mine below clearly show that MailScanner logging comes with
>> wrong facility into syslog.
>>
>> This might be some perl or perl module weirdness below MailScanner, but
>> it's definitely not a config problem with syslog.
>>
>> I suspect that things (open files / handles) get messed up while forking
>> the childs. I'm not good enough at perl and deep enough into MailScanner
>> to dig through this though.
>>
>>    Tom
>>
>>      
>>> 2009/3/26 Tom Weber<l_mailscanner at mail2news.4t2.com>:
>>>        
>>>> Hello,
>>>>
>>>> last month there was a thread from Greg Deputy about Mailscanner not
>>>> logging correctly to syslog. While Greg probably worked around his
>>>> problem, I think it still exists.
>>>>
>>>> On debian lenny with Mailscanner from testing (4.74.16-1) I get logging
>>>> like this:
>>>>
>>>> 1,6,Mar 26 01:06:18,MailScanner: MailScanner setting GID to postfix (333)
>>>> 1,6,Mar 26 01:06:18,MailScanner: MailScanner setting UID to postfix (333)
>>>> 2,6,Mar 26 01:06:19,MailScanner[9707]: MailScanner E-Mail Virus Scanner version 4.74.16 starting...
>>>> 2,6,Mar 26 01:06:19,MailScanner[9707]: Read 848 hostnames from the phishing whitelist
>>>> 2,6,Mar 26 01:06:19,MailScanner[9707]: Read 4278 hostnames from the phishing blacklist
>>>> 2,6,Mar 26 01:06:19,MailScanner[9707]: Using SpamAssassin results cache
>>>> 2,6,Mar 26 01:06:19,MailScanner[9707]: Connected to SpamAssassin cache database
>>>> 2,6,Mar 26 01:06:19,MailScanner[9707]: Enabling SpamAssassin auto-whitelist functionality...
>>>> 19,7,Mar 26 01:06:20,check[9707]: [ 2] [bootup] Logging initiated LogDebugLevel=3 to sys-syslog
>>>> 19,7,Mar 26 01:06:21,check[9707]: [ 3] mail 1 is not known spam.
>>>> 2,6,Mar 26 01:06:24,MailScanner[9713]: MailScanner E-Mail Virus Scanner version 4.74.16 starting...
>>>> 2,6,Mar 26 01:06:24,MailScanner[9713]: Read 848 hostnames from the phishing whitelist
>>>>          
>>
>>      
> Is it only showing up in Debian?
> I don't have any problems in CentOS, maybe something is broken in a Debian
> perl module or the Debian package. Or maybe the Debian package inits too early
> and breaks something there?
>    
I would be very interested if you could narrow this down. It has *never* 
(to my knowledge) occurred in a RedHat or CentOS Linux system, nor any 
other Unix system at all. It only appears to be a few Debian Linux guys 
who have the problem. I must admit that does rather tend to point the 
finger...
There is nothing in MailScanner that will make it "run to mummy" and 
syslog to "mail" rather than what you request in the config file. Feel 
free to read the code in "Log.pm", you can read it just the same as I can.

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
PGP public key: http://www.jules.fm/julesfm.asc


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.