Logcheck users - May 2005 - Postfix body_check loops with logcheck

Hi,
I'm running several mailservers with postfix and make use of the
body_checks [1] feature.
In case of a matching pattern from body_checks postfix will log a line
like this one:
May  9 13:43:00 kemp postfix/cleanup[16469]: 4EFF81FC001: reject: body
?name=3D"your_text.pif";
from=3D<20041224120517.9422.qmail@ildsys.com>
to=3D<dennis@stormbind.net>: Message content rejected

The problem is that logcheck includes suchs errors in the report mails and
they're caught by the body_checks again and we end up in a loop.
I don't want to blame postfix nor logcheck to be the root of the problem so
we came up with some ideas how to work around this problem.

1) Filter out the body_check rejects with a ignore pattern.
+ easy to implement
- may suppress important information

2) Modify the reject message so it no longer matches the body_checks
+ we keep at least parts of the information and can if needed check the
logfiles
- requires to modify logcheck

3) Sent mime encoded mails (thats what the postfix guys suggest to do)
+ keeps all informations
- requires a new dependency for logcheck (mpack)
- requires to modify logcheck
- some (bad) MUAs get confused=20
 =20
4) bypass body_checks for local mail [2]
+ keeps all information
- malicious local users can use this hole
- modify your postfix setup


Do you have other ideas?

I don't know if other people with other MTAs suffer from the same problem
or if it's just a postfix related problem.

Personaly I'm now using (1) to work around the problem but I would prefer
to use (2) or (3). About 3 years ago I modified the original psionic logcheck
to solution (3). Now I would like to find a solution that the upstream team
agrees to so that other people can benefit from it.

I know that similar software like logwatch generates similars problems so
it might be better to resolv the problem with (4) but first I would like to
know if other people might have a better solution in mind.

Sven

[1] http://www.postfix.org/postconf.5.html
[2] http://www.seaglass.com/postfix/turning_off_body_checks.html
--=20
Das Fernsehen ist die gr=F6=DFte kulturelle Katastrophe, die die Erde in der
Zeit,
an die wir uns erinnern k=F6nnen, erlebt hat.
	[ Joseph Weizenbaum ]