Lots of logged info when using demime condition to block attachment types

"Eli" <[email protected]>
Newsgroups gmane.mail.exim.exiscan.user
Message-ID <200407020141375.SM01136@nutbar>
I've noticed on my servers that I get way too much info logged to syslog
(what I use to log all exim log data) when the demime ACL condition blocks
an attachment type.

Here's the ACL section that's responsible for blocking the email (BTW, this
is not the MIME ACL - this is being called by the old style DATA ACL):

acl_check_mime:
        accept  authenticated   = *

        deny    message         = Message contains MIME errors:
$demime_reason
                demime          = *
                condition       = ${if > {$demime_errorlevel}{2} {yes}{no}}

        deny    message         = Message contains a blocked attachment:
*.$found_extension
                demime          = exe : com : bat : vbs : pif : lnk : scr

        accept


And here's what I get in the log file:

Jul  2 00:10:23 scanmail1 exim[23743]: [1\16] 2004-07-02 00:10:23
1BgFNM-0006Ax-LU H=(removed_for_privacy) [removed_for_privacy]
F=<removed_for_privacy> rejected after DATA:
Message contains a blocked attachment: *.exe
Jul  2 00:10:23 scanmail1 exim[23743]: [2\16] Envelope-from:
<removed_for_privacy>
Jul  2 00:10:23 scanmail1 exim[23743]: [3\16] Envelope-to:
<200403120302.AA127468056@removed_for_privacy>
Jul  2 00:10:23 scanmail1 exim[23743]: [4\16] P Received: from
[removed_for_privacy] (helo=removed_for_privacy)
Jul  2 00:10:23 scanmail1 exim[23743]: [5\16] ^Iby removed_for_privacy with
smtp (Exim 4.34)
Jul  2 00:10:23 scanmail1 exim[23743]: [6\16] ^Iid 1BgFNM-0006Ax-LU
Jul  2 00:10:23 scanmail1 exim[23743]: [7\16] ^Ifor
200403120302.AA127468056@removed_for_privacy; Fri, 02 Jul 2004 00:10:23
-0400
Jul  2 00:10:23 scanmail1 exim[23743]: [8\16]   Date: Fri, 02 Jul 2004
09:40:02 +0530
Jul  2 00:10:23 scanmail1 exim[23743]: [9\16] T To: ""
<200403120302.AA127468056@removed_for_privacy>
Jul  2 00:10:23 scanmail1 exim[23743]: [10\16] F From: <removed_for_privacy>
Jul  2 00:10:23 scanmail1 exim[23743]: [11\16]   Subject: Re: Hi
Jul  2 00:10:23 scanmail1 exim[23743]: [12\16] I Message-ID:
<vcflibgruxlwaspyyxs@removed_for_privacy>
Jul  2 00:10:23 scanmail1 exim[23743]: [13\16]   MIME-Version: 1.0
Jul  2 00:10:23 scanmail1 exim[23743]: [14\16]   Content-Type:
multipart/mixed;
Jul  2 00:10:23 scanmail1 exim[23786]: 2004-07-02 00:10:23 no host name
found for IP address removed_for_privacy
Jul  2 00:10:23 scanmail1 exim[23743]: [15\16]
boundary="--------gdgmhvdjsmwtymazzsri"
Jul  2 00:10:23 scanmail1 exim[23743]: [16/16]   X-Headers-Begin:
1BgFNM-0006Ax-LU

I never see this kind of logged output unless it blocks an email - all the
other demime conditions used in my ACLs never produce such output that I've
seen.  Is there any way to turn it off?  I just want to see a single line
stating it was blocked because of the attachment - I don't need the full set
of headers (causes lots of unnecessary data in my logfiles, which hit about
200mb a day).

I'm using the latest Exiscan release:

Exim version 4.34 #2 built 21-Jun-2004 17:40:36
Copyright (c) University of Cambridge 2004
Berkeley DB: Sleepycat Software: Berkeley DB 4.1.24: (September 13, 2002)
Support for: iconv() OpenSSL
Lookups: lsearch wildlsearch nwildlsearch iplsearch dbm dbmnz mysql
Authenticators: cram_md5 plaintext
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply pipe smtp
Fixed never_users: 0
Contains exiscan-acl patch revision 22 (c) Tom Kistner
[http://duncanthrax.net/exiscan/]
Configuration file is /etc/exim.conf

Thanks!

Eli.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.