Fwd: Suggestion for clamav-milter

---------- Forwarded message ----------
From: Win Bent <[email protected]>
Date: Nov 26, 2007 5:51 PM
Subject: Suggestion for clamav-milter
To: [email protected]
Cc: Win Bent <[email protected]>


Logwatch 7.3 (released 03/24/06)
/usr/share/logwatch/scripts/services/clamav-milter ver. 0.85.1

I'm not sure why, but when I run logwatch on my system, clam-update
finds nothing, while clamav-milter finds many messages relating to
updating and reloading the daemon.

Also, the "max-children limit" message produces several lines - this
change ignores all but one.

Finally, the "Infected Messages" section now prints a total count of infections.

--- -   2007-11-26 18:46:11.240888000 -0600
+++ clamav-milter       2007-11-24 16:40:43.000000000 -0600
@@ -26,7 +26,16 @@
        ( $ThisLine =~ /^clamav-milter (startup|shutdown) succeeded$/ ) or
        ( $ThisLine =~ /^Quarantined infected mail as/ ) or
        ( $ThisLine =~ /^File quarantined as/ ) or
-       ( $ThisLine =~ /^ClamAv: mi_stop/ )) {
+       ( $ThisLine =~ /^ClamAv: mi_stop/ ) or
+       # These two go along with "max-children limit" so we ignore them
+       ( $ThisLine =~ /n_children \d+: waiting \d+ seconds for some
to exit/ ) or
+       ( $ThisLine =~ /Finished waiting, n_children = \d+/ ) or
+       # These 3 precede "correctly reloaded" (we hope)
+       # - Toss-up: Keep "correctly reloaded" or "Protecting against"?
+       ( $ThisLine =~ /^Database has changed, loading updated database/ ) or
+       ( $ThisLine =~ /^Loaded ClamAV \d+\./ ) or
+       ( $ThisLine =~ /^ClamAV: Protecting against \d+ viruses/ ) or
+       0 ) {
        # We do not care about these.
    } elsif (($ThisLine =~ /clean message from/)) {
       $CleanMessage++;
@@ -47,6 +56,9 @@
       $DaemonStop++;
    } elsif (($ThisLine =~ /^Starting/)) {
       $DaemonStart++;
+   } elsif (($Viruses) = ($ThisLine =~ /^Database correctly reloaded
\((\d+) (signatures|viruses)\)/i )) {
+      $DatabaseReloads++;
+      $DatabaseViruses = $Viruses;
    } else {
       push @OtherList,$ThisLine;
    }
@@ -61,8 +73,12 @@
    print "\nDaemon started: " . $DaemonStart . " Time(s)\n";
 }

+if (($DatabaseReloads) and ($Detail >= 5)) {
+   print "\nVirus database reloaded $DatabaseReloads time(s) (last
time with $DatabaseViruses viruses)\n";
+}
+
 if (keys %MaxChildrenLimit) {
-   print "\nHit max-hildren limit:\n";
+   print "\nHit max-children limit:\n";
    foreach $Limit (sort {$a cmp $b} keys %MaxChildrenLimit) {
       print '   Limit ' . $Limit . ' children(s) exceeded ' .
$MaxChildrenLimit{$Limit} . " Time(s)\n"
    }
@@ -73,10 +89,13 @@
 }

 if (keys %VirusList) {
+   my $Total = 0;
    print "\nInfected messages:\n";
    foreach $Virus (sort {$a cmp $b} keys %VirusList) {
       print '   ' . $Virus . ": ". $VirusList{$Virus} . " Message(s)\n";
+      $Total += $VirusList{$Virus};
    }
+   print "  Total: $Total\n";
 }

 if (($#OtherList >= 0) and (not $IgnoreUnmatched)){

My apologies if you think this should be a Patch rather than a Suggestion.

        - Win
--
Win Bent, Head          [email protected]
Bent Sound Research     Sound advice for over 30 years!




-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration