Re: SA: Message normalization...

On Wed, Aug 27, 2003 at 06:28:20PM -0700, Chirik wrote:
>   Looking at writing my own utility to collect sa-exim statistics, and going
> over the message.  Most of the messages were rewritten to be standard, but a
> few still aren't.  Just some thoughts - I could try these on my own setup,

You're right, I need to fix them.

> Tagged as 'Action', but doesn't include (scanned in ...):
>   "SA: Action: spamd took more than %d secs to run, accepting message. %s", SAtimeout, mailinfo
 
Fixed.
 
> Format differs slightly from the rest:
>   "SA: Action: flagged as Spam but accepted: Score %s (scanned in %d/%d secs | Message-Id: %s). %s", spamstatus, scantime, fulltime, safemesgid, mailinfo
> 
> Remove the word 'Score ' from the message, so it matches the rest of the
> messages:
>   "SA: Action: flagged as Spam but accepted: %s (scanned in %d/%d secs | Message-Id: %s). %s", spamstatus, scantime, fulltime, safemesgid, mailinfo

Done.
 
> Perhaps these two should be promoted from 'Notice' to 'Action' (if that
> requires significant processing that would otherwise be skipped, then
> leaving them alone makes sense)
> "SA: Notice: check skipped due to message size (%d bytes) and SATruncBodyCond expanded to false", fdsize-18
> "SA: Notice: Not running SA because SAEximRunCond expanded to false"
 
> How about:
> "SA: Action: check skipped due to message size (%d bytes) and SATruncBodyCond expanded to false (scanned in 0/0 secs | Message-Id: %s)", fdsize-18, safemesgid, mailinfo
> "SA: Action: Not running SA because SAEximRunCond expanded to false (scanned in 0/0 secs | Message-Id: %s). %s", safemesgid, mailinfo

You could debate that one, but I initially picked "Action" for anything
where spamc was run. In those two cases, it isn't, so there was no real
action as far as spamc is concerned.
I know what you mean though, it's the action on the message itself

I went ahead and did the change, but didn't put 'scanned in 0/0 secs'.
It felt silly, and it won't really help with the parsing anyway because
those two lines have different fields anyway.

I'll submit this to CVS tonight.

Thanks
Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/   |   Finger [email protected] for PGP key