[SA-exim] logfile entry for max. teergrube time

[Marc MERLIN]

On Wed, May 21, 2003 at 01:44:38PM -0700, Marc MERLIN wrote:
> On Tue, May 20, 2003 at 09:39:30PM +0200, Martin Balvers wrote:
> > Hi,
> > 
> > I am writing a logparser for sa-exim logfiles (exim_mainlog).
> > I was wondering why the scantime and the message recipient are not logged
> > when a teergrube takes the fully configured amount of time.
> > If the spammer/sender closes the connection before the max. configured
> > teergrube time, both scantime and recipient address are logged.
> 
> It's an oversight in the logging. I'll fix that.

It's fixed in CVS, although I probably won't have the time to release
SA-Exim 3.1 for a while, so that probably doesn't help you too much
(I loathe to make a new release just for this small patch, so it'll wait
until I fix a couple of other things, and maybe add another feature, but
I'll add that in CVS)

In the meantime, here's the patch:
RCS file: /cvsroot/sa-exim/sa-exim/sa-exim.c,v
retrieving revision 1.38
diff -u -r1.38 sa-exim.c
--- sa-exim.c   30 Apr 2003 16:07:59 -0000      1.38
+++ sa-exim.c   8 Jun 2003 23:49:34 -0000
@@ -1186,7 +1186,7 @@
                sleep(10);
            }
 
-           log_write(0, LOG_MAIN | LOG_REJECT, "SA: Action: teergrubed sender until full configured duration of %d secs (%s)", SAteergrubetime, spamstatus);
+           log_write(0, LOG_MAIN | LOG_REJECT, "SA: Action: teergrubed sender until full configured duration of %d secs: %s (scanned in %d/%d secs). %s", SAteergrubetime, spamstatus, scantime, fulltime, mailinfo);
            *return_text=string_sprintf(SAmsgteergruberej, spamstatus);
            return LOCAL_SCAN_TEMPREJECT_NOLOGHDR;
        }

You can also get it from CVS
Hopefully it won't be too hard for your parser to recognize the old
and new log formats

Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/   |   Finger marc_f at merlins.org for PGP key