qms-analog log files are of the general form: :processID:LOGTYPE:... LOGTYPES and associated parameters are listed below: *Info* ------------------------------------------------------------------------------- -* - remark line CONNECT-SMTP: - SMTP connect from IP CONNECT-PIPE: - SMTP connect from process SMTP-DROP - qmail dropping msg HEADER:::subject - SMTP header contents ENV-HEADER::: - envelope header contents TYPE:PLAIN - message has no mime type or text/plain TYPE:MIXED - message has non-text/plain mime type SCANTIME: - total time in qmail-scanner SPAM-RESULT::::: - spamassassin score for msg ERROR:: - error condition *Flagged Msgs* ------------------------------------------------------------------------------- QMSWC: - QMS working copy detection BAD_HDR_CHARS - bad chars in hdr BAD_HDR_BREAKAGE - breakage in header name BAD_HDR_MIME - Disallowed mime content in hdr name BAD_MIME_CONTENT - Disallowed mime content type BAD_MIME_FILENAME - Disallowed MIME filename manipulation BAD_MIME_BOUNDARY - broken attachment MIME details BAD_MIME_ASSOCIATION - Disallowed file associated with unrelated MIME type BAD_MIME_WINBLOWS - Disallowed executable attachment (windows) BAD_ATTACH_FILENAME - Disallowed attachment filename MIME type BAD_MIME_ZIP - Disallowed zip attachment when not assoc with a .zip PERLSCAN: - PerlScan detection BAD_MIME_HEADER - Disallowed characters found in MIME headers BAD_HDR_DB - hdr type in disallowed db BAD_ATTACH_LENGTH - majorly long attachment filename found BAD_ATTACHMENT_TYPE - Disallowed attachment type UNZIP:PASSWORD_PROTECTED - zip file is password protected CLAMAV: - clamAV found a virus AVPAV: - AVPLinux AV found a virus CSAV: - Command scanner AV found a virus FPROTAV: - F-prot scanner AV found a virus FSECUREAV: - Fsecure AV found a virus HBEDVAV: - H+BEDV scanner AV found a virus INNOCAV: - Innoculan AV found a virus ISCANAV: - Iscan AV found a virus RAVLINAV: - Ravlin AV found a virus UVSCANAV: - McAfee AV found a virus VEXIRAV: - Vexira AV found a virus SPAM-DETECT: - spamassassin spam detected DELETE - score > thresh + delete MARK - thresh < score < thresh + delete QUARANTINE - thresh + quarantine < score < thresh + delete REJECT - SMTP reject sent to sender