Amavisd logging question

[Bill Landry]

On 3/8/2011 6:57 AM, Mark Martinec wrote:
> Bill,
>
>>>> I have been noticing for quite some time that amavisd-new logs test
>>>> results messages to the maillog differently at time.  For example:
>>>>
>>>> Feb 27 14:22:06 mail amavis[27931]: (27931-08) Passed CLEAN
>>>> Feb 27 14:22:56 mail ch4-03611-04)[3611]: (03611-04) Passed CLEAN
>>>>
>>>> These are 2 different message that amavisd-new tested and reported to
>>>> the maillog as "Passed CLEAN".  However, notice that the first log entry
>>>> clearly shows it came from "amavis", but the second log entry show it
>>>> came from "ch4-03611-04)".  Note that there is also a closing ")" is the
>>>> second log entry but no opening "(".
>>>>
>>>> Any ideas why this is happening and what I can do to fix it?  I am
>>>> currently running amavisd-new-2.6.4 (20090625).
>>>
>>> What syslog variant are you using?
>>> Looks like part of a process name ($0) ends up as a syslog ident.
>
>> I'm running Fedora 12:
>> Linux mail.inetmsg.com 2.6.32.26-175.fc12.i686.PAE #1 SMP Wed Dec 1
>> 21:45:50 UTC 2010 i686 athlon i386 GNU/Linux
>> rsyslogd 4.4.2, compiled with: [...]
>
> I just came across a note in the syslog(3) man page on Linux:
>
>    The argument 'ident' in the call of openlog() is probably stored as-is.
>    Thus, if the string it points to is changed, syslog() may start prepending
>    the changed string, and if the string it points to ceases to exist, the results
>    are undefined.
>
> Perhaps using a static variable would help, in case the Unix::Syslog
> module does not cope with this detail.
>
> Could you please try the attached patch for 2.6.4 (same for 2.7.0).

Mark, I've applied the patch and so far things are looking good. 
Usually I see about 500 of these "Mar  8 04:26:36 mail ch25-04407-25)" 
type entries in the maillog per day, so I'll report back tomorrow on 
whether the patched resolved this or not.

Thanks for the awesome support you always provide for amavisd!

Best regards,

Bill