after so many trouble with freshclam, in zimbra and in all other clamav installation, i cannot think of freshclam without syslog;
this is my diff:
Code:
diff /opt/zimbra/conf/freshclam.conf freshclam.conf
17c17
< UpdateLogFile /opt/zimbra/log/freshclam.log
---
> # UpdateLogFile /opt/zimbra/log/freshclam.log
25a26
> LogFileMaxSize 0
29c30
< #LogTime yes
---
> LogTime yes
33c34
< #LogVerbose yes
---
> LogVerbose yes
37c38
< #LogSyslog yes
---
> LogSyslog yes
42a44
> LogFacility LOG_LOCAL6
67c69,70
< DatabaseMirror db.us.clamav.net
---
> # DatabaseMirror db.us.clamav.net
> DatabaseMirror db.it.clamav.net
135c138
< #Debug yes
---
> Debug yes
then i rotate freshclam syslog logs with logrotate:
Code:
local6.* /var/log/freshclam.log
local0.* -/var/log/zimbra.log
auth.* -/var/log/zimbra.log
mail.* -/var/log/zimbra.log
btw: why the hell auth.* is logged into zimbra.log??!?!
so all ssh brute force attempts are logged there??

and mail.*..is there and in maillog, too, i don't like it