How to get rid of "connection open|reset|close" in syslog?

Discussion in 'NOD32 version 2 Forum' started by herira, Apr 23, 2007.

Thread Status:
Not open for further replies.
  1. herira

    herira Registered Member

    Joined:
    Apr 23, 2007
    Posts:
    5
    Hi

    I've just installed "NOD32 for Linux/BSD Mail Server" (licensed) on a mail gateway.

    I'm using the "Content filtering in MTA Postfix" method, daisy chaining with amavisd-new like this (port numbers in brackets, all services on same host):

    World -> [25]postfix -> [2526]nod32smtp -> [10024]amavisd-new -> [10025]postfix -> [25]World


    Nod32 version: nod32 (nod32ls) 2.70.5 (from nod32 -v).
    Postfix version: 2.3.6.
    Amavisd-new: 2.4.5


    Things seems to be working according to plan, but how do I get rid of all the "connection open|reset|close" syslog entries, without loosing the "summary" entries as well?


    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0100]: Connection open attempt
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0100]: Connection open success
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0101]: Connection reset attempt
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0101]: Connection reset success
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0101]: Connection reset attempt
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0101]: Connection reset success
    Apr 23 14:50:12 mail1 nod32d[12228]: summary[2fc4021e]: vdb=9638, agent=smtp, msgid=<xxx@xxxx>, sndr=""Kara" <xxxxx@xxxxx.xx>", rcpt="<xxx@xxxxxxx.xx>", object="email message", name="mail", virus="is OK", action="", info="", lines=0
    Apr 23 14:50:12 mail1 nod32smtp[12234]: summary[2fca0101]: action="accepted"
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0101]: Connection reset attempt
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0101]: Connection reset success
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0101]: Connection close attempt
    Apr 23 14:50:12 mail1 nod32smtp[12234]: note[2fca0101]: Connection close success


    The above is what I currently get in my log per clean mail. :blink:

    Seems to me all the "connection" lines are really just internal nod32 debugging information.

    Nod32 uses syslog with nod32.cfg set to "log_level = 3" and "log_mask = "11111111111"".

    Lowering the log_level to 2 will get rid of the "summary" lines (which I want to keep), but keep the "connection" lines (which I want to loose)...


    Thanks
    Henning
     
Thread Status:
Not open for further replies.