On 8-Nov-2009, at 21:33, Matt Kettler wrote:
However, that assumes you can tell from the log message alone.. I'm
not sure offhand if spamd has that info in the syslog messages.
It doesn't. All virtual domains get scanned as the virtual mailbox
user.
Nov 9 06:47:17 mail spamd[439]: spamd: identified spam (5.8/5.0) for
vpopmail:89 in 6.0 seconds, 2910 bytes.
Nov 9 06:47:17 mail spamd[439]: spamd: result: Y 5 -
BAYES_95,HTML_MESSAGE,MISSING_SUBJECT,URIBL_OB_SURBL
scantime
=
6.0
,size
=
2910
,user
=
vpopmail
,uid
=
89,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=65314,mid=<col121-w21e61fb2bdc3ca21457ee6d1...@phx.gbl
>,bayes=0.975174,autolearn=no
You can use the message ID to scan the log and find the Queue-ID and
then use that to scan the log again for the Queue-ID and THEN you can
get the user/domain.
--
I WILL NOT HANG DONUTS ON MY PERSON
Bart chalkboard Ep. 2F13
