<?xml version="1.0" ?><html>
<head>
<title></title>
</head>
<body>
<div align="left"><font face="Arial"><span style="font-size:10pt">On 30 Apr 2004 at 8:59, Julian Field wrote:</span></font></div>
<div align="left"><br/>
</div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> You can't do that without changing the parser. You got away with it as</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> you also mistakenly changed the separator from ":: " to "::" so it</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> didn't pick up your change. I'll fix it for you and put it in 4.30.</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> </span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> At 15:32 29/04/2004, you wrote:</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> >The purpose of the patch is to</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> >change the syslog output for ClamAVmodule and SophosSAVI from:</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> ></span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> >MailScanner[29668]: INFECTED:: W32/Bagle-AA:: (pathname)</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> >MailScanner[29668]: INFECTED:: Worm.Bagle.Z:: (pathname)</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> ></span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> >to:</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> ></span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> >MailScanner[24988]: INFECTED::SophosSAVI:: W32/Bagle-AA:: (pathname)</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> >MailScanner[24988]: INFECTED::ClamAVModule:: Worm.Bagle.Z::</span></font></div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">> >(pathname)</span></font></div>
<div align="left"><br/>
</div>
<div align="left"><br/></div>
<div align="left"><font face="Arial"><span style="font-size:10pt">I wonder if it would be better to change it to something like:</span></font></div>
<div align="left"><br/>
</div>
<div align="left"><font face="Arial" color="#0000ff"><span style="font-size:10pt">MailScanner[24988]: SophosSAVI::INFECTED:: W32/Bagle-AA:: (pathname)</span></font></div>
<div align="left"><br/>
</div>
<div align="left"><font face="Arial"><span style="font-size:10pt">so it wouldn't break all of the log parsing scripts that currently search for INFECTED
and expect to find the virus name immediately after.</span></font></div>
<div align="left"><br/>
</div>
<div align="left"><font face="Arial"><span style="font-size:10pt">--</span></font></div>
<div align="left"><font face="Arial"><span style="font-size:10pt">Mark W. Nienberg, SE</span></font></div>
<div align="left"><font face="Arial"><span style="font-size:10pt">Tipping Mar + associates</span></font></div>
<div align="left"><font face="Arial"><span style="font-size:10pt">1906 Shattuck Ave, Berkeley, CA 94704</span></font></div>
<div align="left"><font face="Arial"><span style="font-size:10pt">(510) 549-1906</span></font></div>
<div align="left"><font face="Arial"><span style="font-size:10pt">visit our website </span></font><a href="http://www.tippingmar.com"><font face="Arial">
<u>www.tippingmar.com</u></font></a></div>
</body>
</html>
-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail@jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html