[Logcheck-users] Postfix body_check loops with logcheck

Sven Hoexter sven@timegate.de
Wed, 11 May 2005 14:50:33 +0200


Hi,
I'm running several mailservers with postfix and make use of the
body_checks [1] feature.
In case of a matching pattern from body_checks postfix will log a line
like this one:
May  9 13:43:00 kemp postfix/cleanup[16469]: 4EFF81FC001: reject: body ?n=
ame=3D"your_text.pif"; from=3D<20041224120517.9422.qmail@ildsys.com> to=3D=
<dennis@stormbind.net>: Message content rejected

The problem is that logcheck includes suchs errors in the report mails an=
d
they're caught by the body_checks again and we end up in a loop.
I don't want to blame postfix nor logcheck to be the root of the problem =
so
we came up with some ideas how to work around this problem.

1) Filter out the body_check rejects with a ignore pattern.
+ easy to implement
- may suppress important information

2) Modify the reject message so it no longer matches the body_checks
+ we keep at least parts of the information and can if needed check the
logfiles
- requires to modify logcheck

3) Sent mime encoded mails (thats what the postfix guys suggest to do)
+ keeps all informations
- requires a new dependency for logcheck (mpack)
- requires to modify logcheck
- some (bad) MUAs get confused=20
 =20
4) bypass body_checks for local mail [2]
+ keeps all information
- malicious local users can use this hole
- modify your postfix setup


Do you have other ideas?

I don't know if other people with other MTAs suffer from the same problem
or if it's just a postfix related problem.

Personaly I'm now using (1) to work around the problem but I would prefer
to use (2) or (3). About 3 years ago I modified the original psionic logc=
heck
to solution (3). Now I would like to find a solution that the upstream te=
am
agrees to so that other people can benefit from it.

I know that similar software like logwatch generates similars problems so
it might be better to resolv the problem with (4) but first I would like =
to
know if other people might have a better solution in mind.

Sven

[1] http://www.postfix.org/postconf.5.html
[2] http://www.seaglass.com/postfix/turning_off_body_checks.html
--=20
Das Fernsehen ist die gr=F6=DFte kulturelle Katastrophe, die die Erde in =
der Zeit,
an die wir uns erinnern k=F6nnen, erlebt hat.
	[ Joseph Weizenbaum ]