spamassassin-users October 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: New plugin: DecodeShortURLs

Re: New plugin: DecodeShortURLs

From: John Horne <john.horne_at_nospam>
Date: Mon Oct 04 2010 - 21:55:13 GMT
To: SpamAssassin <users@spamassassin.apache.org>

On Thu, 2010-09-23 at 11:30 +0100, Steve Freegard wrote:
> >
> > Hopefully it will be useful to others; you can grab it from:
> >
> > http://www.fsl.com/support/DecodeShortURLs.pm
> > http://www.fsl.com/support/DecodeShortURLs.cf
> >
>
...
>
> - Added option to allow logging to syslog (mail.info).
>
Hello,

I grabbed a copy of the above plugin and tried it this afternoon (on a
CentOS 5.5 system). We log all our spamd messages to /var/log/maillog
via syslog. For the plugin I disabled all the options except
'url_shortener_syslog' which was set to 1.

After restarting SpamAssassin we started to get some messages from spamd
sent to /var/log/mailog and some sent to /var/log/messages. Not messages
from the plugin, but any messages from spamd. For example
(from /var/log/messages):

   Oct 4 22:28:50 pat sauser[31061]: spamd: checking message
   <79d9f28c0f1f811a22d92293e4e41c04@www.facebook.com> for sauser:10001
   Oct 4 22:28:56 pat sauser[31061]: spamd: clean message (-0.1/8.0)
   for sauser:10001 in 5.6 seconds, 7896 bytes.
   Oct 4 22:28:56 pat sauser[31061]: spamd: result: . 0 -
   BAYES_00,DCC_CHECK,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,
     HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS
     scantime=5.6,size=7896,user=sauser,uid=10001,required_score=8.0,
     rhost=localhost.localdomain,raddr=127.0.0.1,rport=38700,
     mid=<79d9f28c0f1f811a22d92293e4e41c04@www.facebook.com>,
     bayes=0.000000,autolearn=no

The messages are not just being duplicated in both files, there are
different messages in each file. Our syslog.conf specifies:

    *.info;mail.none /var/log/messages
    mail.* -/var/log/maillog

I tried changing DecodeShortURLs.pm calls to syslog to use 'info|mail'
and that made no difference. I also tried commenting out the 'syslog'
calls, and used backtick calls to '/usr/bin/logger' instead. The same
problem happened. If I take the plugin out, then all messages from spamd
go to /var/log/maillog as before.

Anyone any ideas as to what is going on?

Thanks,

John.

-- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 Fax: +44 (0)1752 587001