<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=ISO-8859-1">
<META content="MSHTML 5.50.4916.2300" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002>In the
:</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002>/etc/syslog.conf file</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002>I
think the rpm might have modified it .. must have because i didnt..
</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002>My
previouse non working line was :</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002># Log
all the mail messages in one place.<BR><FONT face="Times New Roman"
color=#000000
size=3>mail.debug</FONT>*;mailscanner.*
/var/log/maillog</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002>
---==== I split them and changed it to:
====---</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002># Log
all the mail messages in one
place.<BR>mail.*
/var/log/maillog</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002># Log
all the mailscanned messages to.</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002>mailscanner.*
/var/log/mailscanner<BR></SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002>now
when i do a </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002>tail
-f /var/log/maillog </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=985175821-19062002>its
working now :)</DIV></SPAN></FONT>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=985175821-19062002></SPAN></FONT> </DIV>
<BLOCKQUOTE>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Julian Field
[mailto:jkf@ECS.SOTON.AC.UK]<BR><B>Sent:</B> Wednesday, June 19, 2002 3:19
PM<BR><B>To:</B> MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Strange
Message<BR><BR></FONT></DIV>At 17:56 19/06/2002, you wrote: <BR>>RH 7.2
<BR>>Sendmail 8.11.6 <BR>>latest RPM fresh install of mailscanner and
all perl updates <BR>> <BR>>When I do a chkconfig --list | grep sendmail
<BR>>It shows 0 - 5 runlevels as off <BR><BR>Correct. You don't want
sendmail to be run from the sendmail <BR>/etc/rc.d/init.d/sendmail script,
which is what <BR>chkconfig --list | grep sendmail <BR>will show you.
<BR><BR>>ps -A | more shows sendmail and mailscanner running <BR><BR>Good.
There should be 2 sendmail processes running, one with something like
<BR>"-q15m" on its command-line, and another accepting connections on port 25.
<BR>And 1 MailScanner process running. <BR><BR>>maillog is not being
written to and there is no sign of a .maillog.swp either <BR><BR>There
shouldn't be a .maillog.swp file as you don't really want to edit <BR>your
logs with vi, which is what that usually implies. <BR><BR>As your maillog
isn't being written to by MailScanner, check that there is <BR>a line in your
/etc/syslog.conf file that says <BR>mail.debug /var/log/maillog <BR>If there
isn't one, then add it and then run the command <BR>/etc/rc.d/init.d/syslog
restart <BR>If you still can't get anything from MailScanner into your
maillog, then <BR>you will need to edit /etc/rc.d/init.d/syslog a little bit.
There is a line <BR>that sets the value of "SYSLOGD_OPTIONS", and this should
say <BR>SYSLOGD_OPTIONS="-r -m 0" <BR>(the new bit is the "-r"). If you make
that change, you will need to <BR>/etc/rc.d/init.d/syslog restart <BR>again so
that it makes use of the change. <BR><BR>>chkconfig mailscanner on (or off)
shows nothing.. I just get the command <BR>>prompt <BR><BR>It doesn't print
anything, but it has the effect of telling Linux whether <BR>to start
MailScanner (or not) the next time the computer boots Linux. If <BR>you have
done this a few times, then you need to ensure it is set to start <BR>on boot.
So do <BR>chkconfig mailscanner on <BR>and then do <BR>chkconfig --list | grep
mail <BR>and you should see that sendmail is switched off at all run levels,
and <BR>mailscanner is switched on at levels 3,4,5. The startup script
<BR>corresponding to this is /etc/rc.d/init.d/mailscanner, which actually not
<BR>only starts MailScanner, but also starts the 2 sendmail processes it
needs. <BR>This is why sendmail is apparently off and mailscanner is on.
<BR><BR>>doing tests im lucky to say mail is being sent.. but have no idea
if <BR>>mailscanner is scanning due to the fact that the maillog is not
being <BR>>written to .. strange? <BR>>my mail log is is in its default
location too... /var/log/maillog so I am <BR>>worried. <BR>>I am sorry
if this seems to be a newbie question, cuz I am :) <BR>>should I execute
these commands in this order? <BR>>chkconfig --add mailscanner <BR>>
>/etc/rc.d/init.d/sendmail stop <BR>> >chkconfig sendmail off
<BR>> >chkconfig --level 2345 sendmail off <BR>> >rm -f
/etc/rc.d/rc2.d/S30sendmail <BR><BR>You can do that if your like, it won't do
any harm. But if you do a <BR>chkconfig --list | grep mail <BR>first you will
probably find you don't need to do them as sendmail will be <BR>off and
mailscanner will be on. <BR><BR>> I have not done this yet.. <BR>>I
guess you could tell im abit scared to do this during a busy time at our
<BR>>company, but need to get mailscanner working properly at this very
<BR>>moment.. ahhh! <BR><BR>A good way to test MailScanner is to send some
mail through it containing <BR>the "eicar" test virus. This is a totally
harmless file which you can <BR>download from www.eicar.org but which will be
detected as a virus by all <BR>the virus scanners. Remember, if sending it
from the same machine as the <BR>one running MailScanner, that you need to
send the mail in via the SMTP <BR>port (25) and you don't just call sendmail
directly. So probably best for <BR>your testing to send the mail from another
PC so you can be sure it is <BR>talking to the MailScanner server by SMTP.
<BR><BR>Hopefully that's enough to get you going. And I hope a few people find
this <BR>info useful in future via the mailing list archives... <BR><BR>Jules.
<BR>>-----Original Message----- <BR>>From: Julian Field
[mailto:jkf@ECS.SOTON.AC.UK] <BR>>Sent: Tuesday, June 18, 2002 11:18 PM
<BR>>To: MAILSCANNER@JISCMAIL.AC.UK <BR>>Subject: Re: Strange Message
<BR>> <BR>>At 22:56 18/06/2002, you wrote: <BR>> >-----Original
Message----- <BR>> >From: Matthew_doherty@DATAWATCH.COM <BR>> >
<BR>> > > Does this mean we have to remove sendmail from RedHats boot
up <BR>> services ? <BR>> > <BR>> >Yep, like I said 2 responses
ago :-) <BR>> >on RH, use chkconfig <BR>> > <BR>> > > Or
does the rpm automatically do that during the install? <BR>> > <BR>>
>nope, it doesn't. <BR>> <BR>>Oh, yes it does. (Cue Punch & Judy
jokes... oh, no it doesn't... oh, yes it <BR>>does... :-) <BR>> <BR>>
From the "%post" script in the RPM spec From the "%post" script in the
<BR>> RPM spec <a href=": <BR>> >chkconfig --add mailscanner
<BR>> >/etc/rc.d/init.d/sendmail stop <BR>> >chkconfig sendmail
off <BR>> >chkconfig --level 2345 sendmail off <BR>> >rm -f
/etc/rc.d/rc2.d/S30sendmail <BR>> <BR>>-- <BR>>Julian Field Teaching
Systems Manager <BR>>jkf@ecs.soton.ac.uk Dept. of Electronics &
Computer Science <BR>>Tel. 023 8059 2817 University of Southampton
<BR>>Southampton SO17 1BJ <BR><BR>-- <BR>Julian Field Teaching Systems
Manager <BR>jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science
<BR>Tel. 023 8059 2817 University of Southampton <BR>Southampton SO17 1BJ
<BR><BR></BLOCKQUOTE></BODY></HTML>