cleanfeed-ng messages in INN news.notice
========================================

Scope
-----

Lines sent through INN::syslog() normally appear in news.notice with the prefix added by
syslog/innd, for example:

    Jul 15 12:34:56 news innd[12345]: filter: <message below>

The destination depends on the local syslog configuration.  The strings below
start at the text following "filter: ".

A. Structured article/policy events
-----------------------------------

    cleanfeed_event action=<ACTION> rule=<RULE> [peer=<PEER>]
        [groups=<GROUPS>] [message_id=<MESSAGE_ID>] [reason="<REASON>"]

The line is written when policy/event logging is enabled.  Optional peer,
groups and Message-ID fields depend on policy_include_peer,
policy_include_groups and policy_include_message_id. 

B. Routine housekeeping/status notices
---------------------------------------

These are expected operational notices and can normally be consumed silently
by innreport after any useful counters have been collected:

    status: accepted <N> rejected <N> [refused <N>] [md5 <N>]
        [phl <N>] [fsl <N>] [arts/s <RATE> accept/s <RATE>]
        [WARNING cleanfeed.local NOT loaded]

        Written only when inn_syslog_status is enabled.

    Reloading external cleanfeed lists

        Written when the mtime/article-count reload logic decides that the
        external bad_*/trusted_* files must be re-read.

    metrics articles=<N> accepted=<N> rejected=<N> audited=<N>
        quarantined=<N>

        Written only when metrics_enabled and metrics_syslog are enabled.

    Saved EMP database.

        Written after a successful periodic EMP database dump.

    Restored EMP database.

        Historical Cleanfeed status text retained by cleanfeed-ng.  Whether it
        can be emitted depends on when INN makes its syslog callback available.

    Meow unto the greatness of Fluffy, Ruler of All Usenet

        Written by filter_close when the embedded filter is closed/reloaded.

The current historical message:

    Reloading bad files

It is not emitted by the current cleanfeed-ng reload implementation, but the
rule should remain for compatibility with older Cleanfeed installations.

C. Configuration and module errors
-----------------------------------

These should NOT normally be hidden.  They indicate a configuration,
dependency or local file problem requiring administrator attention:

    Cannot load <LOCAL_CONFIG_FILE>: <PERL_ERROR>
    Cannot open <LOCAL_CONFIG_FILE>: <OS_ERROR>
    Cannot open <ACTIVE_FILE>: <OS_ERROR>

    Configuration validation failed: <DETAIL>

    Cannot load MD5: <PERL_ERROR>
    Cannot load Data::Dumper: <PERL_ERROR>
    Cannot load IO::File: <PERL_ERROR>

D. External list/regular-expression errors
------------------------------------------

    Ignoring unsafe <LIST_NAME> regex; keeping previous compiled value

    Ignoring invalid <LIST_NAME> regex; keeping previous compiled value:
        <PERL_REGEX_ERROR>

    Cannot open <EXTERNAL_LIST_PATH>: <OS_ERROR>

E. Atomic output/statistics errors
----------------------------------

    Cannot create temporary file <PATH>: <OS_ERROR>
    Cannot write temporary file <PATH>: <OS_ERROR>
    Cannot close temporary file <PATH>: <OS_ERROR>
    Cannot rename <TEMP_PATH> to <FINAL_PATH>: <OS_ERROR>
    Cannot append <CSV_PATH>: <OS_ERROR>
    Cannot open <STATFILE_PATH>: <OS_ERROR>

F. Debug/article-log and EMP persistence errors
-----------------------------------------------

    Cannot open <DEBUG_OR_BATCH_FILE>: <OS_ERROR>
    EMP database could not be dumped: <OS_ERROR>

G. Rejection lines generated by innd
------------------------------------

They are generated by innd when the embedded Perl filter returns a rejection:

    rejecting[perl] <MESSAGE-ID> <SIZE> <REJECTION_REASON>


Recommended innreport treatment
-------------------------------

Dedicated cleanfeed-ng section:

    filter: cleanfeed_event ...

Consume as routine housekeeping:

    filter: status...
    filter: Reloading bad files...
    filter: Reloading external cleanfeed lists...
    filter: Saved EMP database...
    filter: Restored EMP database...
    filter: metrics articles=...
    filter: Meow unto the greatness of Fluffy...

Leave visible as warnings/errors:

    filter: Cannot ...
    filter: Configuration validation failed: ...
    filter: Ignoring unsafe ...
    filter: Ignoring invalid ...
    filter: EMP database could not be dumped: ...
