Red Hat Bugzilla – Bug 204432
**Unmatched Entries** when using with mailman, amavis and spamassassin
Last modified: 2007-11-30 17:11:41 EST
Description of problem:
The amavis script in logwatch doesn't detect lines generated by mailman when it
resends a spam message to a list. The different entries in /var/maillog are as
- Spam message for a list:
Aug 27 04:08:42 hostname amavis: (14372-09) Passed SPAM, [184.108.40.206]
[220.127.116.11] <email@example.com> -> <firstname.lastname@example.org>, Message-ID:
<000b01c6c97d$b595b4a0$5baf6650@pc>, mail_id: UFL+vAvISpyg, Hits: 15.09,
queued_as: 02D333B6383, 6025 ms
- Spam message from mailman to the list owners:
Aug 27 04:08:46 hostname amavis: (14372-10) Passed SPAM, LOCAL
[127.0.0.1] [127.0.0.1] <email@example.com> ->
<firstname.lastname@example.org>, mail_id: SBYKf6j5a2Nx, Hits:
9.659, queued_as: D2D1D3B6387, 1887 ms
The only difference is the word "LOCAL" after "Passed SPAM".
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Install mailman, amavis and spamassassin.
Configure amavis to pass spam to the users.
2. Get some spam sent to any mailman list.
3. Wait for logwatch to run.
All spam messages re-sent from mailman appear under **Unmatched Entries** in
No **Unmatched Entries**. I'm not sure how these messages should be actually
counted, or if they should be counted at all, but they should certainly not
appear under unmatched entries.
I modified logwatch's amavis script to get rid of those lines. I enclose the
diff file (patch file?). The only problem is that spam messages to the mailing
lists are counted twice.
Created attachment 135101 [details]
Patch for amavis script: /usr/share/logwatch/scripts/services/amavis
Fixed in logwatch-7.3-5