Description of problem: The amavis script in logwatch doesn't detect lines generated by mailman when it resends a spam message to a list. The different entries in /var/maillog are as follows: - Spam message for a list: Aug 27 04:08:42 hostname amavis[14372]: (14372-09) Passed SPAM, [80.102.175.91] [80.102.175.91] <kfxxov> -> <gc>, Message-ID: <000b01c6c97d$b595b4a0$5baf6650@pc>, mail_id: UFL+vAvISpyg, Hits: 15.09, queued_as: 02D333B6383, 6025 ms - Spam message from mailman to the list owners: Aug 27 04:08:46 hostname amavis[14372]: (14372-10) Passed SPAM, LOCAL [127.0.0.1] [127.0.0.1] <gc-bounces> -> <gc-owner>, Message-ID: <mailman.1199.1156644523.5005.gc>, mail_id: SBYKf6j5a2Nx, Hits: 9.659, queued_as: D2D1D3B6387, 1887 ms The only difference is the word "LOCAL" after "Passed SPAM". Version-Release number of selected component (if applicable): logwatch-7.2.1-1.fc5 How reproducible: Always. Steps to Reproduce: 1. Install mailman, amavis and spamassassin. Configure amavis to pass spam to the users. 2. Get some spam sent to any mailman list. 3. Wait for logwatch to run. Actual results: All spam messages re-sent from mailman appear under **Unmatched Entries** in logwatch report. Expected results: No **Unmatched Entries**. I'm not sure how these messages should be actually counted, or if they should be counted at all, but they should certainly not appear under unmatched entries. Additional info: I modified logwatch's amavis script to get rid of those lines. I enclose the diff file (patch file?). The only problem is that spam messages to the mailing lists are counted twice.
Created attachment 135101 [details] Patch for amavis script: /usr/share/logwatch/scripts/services/amavis
Fixed in logwatch-7.3-5