logwatch reporting Unmatched Entries

[Patrick Ben Koetter]

* Robert Moskowitz <rgm at htt-consult.com>:
> This is a new, test, build on CentOS7, amavis-new 2.11.1
> 
> every day I see the following in the logwatch report
> 
> 
>  **Unmatched Entries**
>         1   Deleting db files __db.002,snmp.db,nanny.db,__db.001,__db.003 in /var/spool/amavisd/db

This is probably a result of amavis being restarted. Do you run sa-update
daily and does it sa-compile and restart amavis afterwards?

>         1   (07387-01) xoFkWZwqm0CN FWD from<root at klovia.htt-consult.com>  -><root at klovia.htt-consult.com>, BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 01E0E92C9

That's a message entering your MTA via SMTP on 10025. Looks like amavis
transporting a message to Postfix.

>         1   No ext program for   .rar, tried: unrar, rar

If you want to scan RAR-archives you should probably install either 'rar' or
'unrar'. Once you've installed one of them, the message will vanish.

> I suspect the 2nd is the logwatch email, as that was the only email processed on that day.

Measure, don't speculate. ;-) Check if the Queue-ID xoFkWZwqm0CN is in the
logwatch email you have on your mind.

> Are any of these something I should/could something about?

I would

- write a rule to ignore "Deleting db..."
- install rar or unrar


p at rick

-- 
[*] sys4 AG
 
https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG,80333 München
 
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief
Aufsichtsratsvorsitzender: Florian Kirstein