At 1/12/2004 02:47 PM -0500, Mick Szucs wrote:
>A message arrived the other day that when it was processed by spamd was logged
>in /var/log/messages instead of /var/log/maillog (like all other mail
>processed by spamd.) The message in question contained a high volume of
>control characters in the headers, including Message-ID. The resulting
>output was:
>
>Jan 9 14:39:23 tachi xïc\202^A^_0Â`\202^A^[\204/ for onramp:10010.
>
>in /var/log/messages. The message was Spam and I have a copy, if anyone is
>interested. I'm not sure if this is a spamd issue or a syslog issue, or both
>(or neither, for that matter.)
I had this, or a similar, issue with my spampd script. I had to add a line to the
part which extracts the Message-ID from the headers and logs it to syslog. This is
code I'd "borrowed" from spamd in the first place, so quite possibly the issue exists
there as well. Here is the block of code affected:
# find the Message-ID for logging (code is originally from spamd)
if ( $inhdr && /^Message-Id:\s+(.*?)\s*$/i ) {
$msgid = $1;
while($msgid =~ s/\([^\(\)]*\)//) {}; # remove comments and
$msgid =~ s/^\s+|\s+$//g; # leading and trailing spaces
$msgid =~ s/\s.*$//; # keep only the first token
$msgid =~ s/%/%%/g; # escape % because Sys::Syslog uses
sprintf()
}
The last line is the new one, and it escapes any % signs in the Message-ID. I don't
use spamd so I can't confirm this to be the case, but seems likely as I think it also
uses Sys::Syslog.
I don't think there's any real damage being done though.
Cheers,
-Max
-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
