On Fri, 17 Oct 2014 00:57:07 +0200 =?UTF-8?B?SsOpcsO0bWUgRHJvdWV0?=
<jerome.dro...@gmail.com> wrote:
> ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]:
> \([-[:digit:]]+\) Passed (CLEAN|SPAM(MY)?)( {RelayedInbound})?,( LOCAL)?(
> \[(IPv6:)?[[:xdigit:].:]{3,39}\](:[[:xdigit:]]{0,5})?){0,2} <[^>]*> ->
> <[^>]*>(,<[^>]*>)*,( quarantine:
> ([[:alnum:]]/)?spam-[-+[:alnum:]]+(\.gz)?,)?( Queue-ID: [[:xdigit:]]*,)?(
> Message-ID: <[^>]+>( \((added by[^)]+|sfid-[_[:xdigit:]]+)\))?,)?(
> Resent-Message-ID: <[^>]+>,)? mail_id: [-+_[:alnum:]]+, Hits:
> (-?[.[:digit:]]*)+, size: [[:xdigit:]]+, queued_as: [[:xdigit:]]+( OK
> id=[-[:alnum:]]+)?, [[:digit:]]+ ms$
It's a shame no-one replied to this bug from 2014 - 10 years later, is
it still valid, and is there still interest in adding it to logcheck?
if so, we'd need an updated ruleset / confirmation nothing has changed
(isnt it "amavisd-new" nowadays?)
