SPAMD/malware: Log service identity with errors. Bug 1740

20 files changed, 157 insertions, 149 deletions

diff --git a/src/src/malware.c b/src/src/malware.c
index 37e380c29..4f4a41952 100644
--- a/src/src/malware.c
+++ b/src/src/malware.c
@@ -118,16 +118,18 @@ return DEFER;
 }
 
 static int
-m_errlog_defer(struct scan * scanent, const uschar * str)
+m_errlog_defer(struct scan * scanent, const uschar * hostport,
+  const uschar * str)
 {
-return malware_errlog_defer(string_sprintf("%s: %s", scanent->name, str));
+return malware_errlog_defer(string_sprintf("%s %s : %s",
+  scanent->name, hostport ? hostport : CUS"", str));
 }
 static int
-m_errlog_defer_3(struct scan * scanent, const uschar * str,
-	int fd_to_close)
+m_errlog_defer_3(struct scan * scanent, const uschar * hostport,
+  const uschar * str, int fd_to_close)
 {
 (void) close(fd_to_close);
-return m_errlog_defer(scanent, str);
+return m_errlog_defer(scanent, hostport, str);
 }
 
 /*************************************************/
@@ -327,7 +329,7 @@ switch (*line)
   case 'A': /* ERR */
     if ((p = strchr (line, '\n')) != NULL)
       *p = '\0';
-    return m_errlog_defer(scanent,
+    return m_errlog_defer(scanent, NULL,
       string_sprintf("scanner failed: %s", line));
 
   default: /* VIR */
@@ -345,7 +347,7 @@ switch (*line)
 	return OK;
 	}
       }
-    return m_errlog_defer(scanent,
+    return m_errlog_defer(scanent, NULL,
       string_sprintf("malformed reply received: %s", line));
   }
 }
@@ -505,7 +507,7 @@ if (!malware_ok)
     default: /* compiler quietening */ break;
     }
     if (sock < 0)
-      return m_errlog_defer(scanent, errstr);
+      return m_errlog_defer(scanent, CUS callout_address, errstr);
     break;
   }
   DEBUG(D_acl) debug_printf("Malware scan: %s tmo %s\n", scanner_name, readconf_printtime(timeout));
@@ -536,7 +538,7 @@ if (!malware_ok)
 
       /* send scan request */
       if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       while ((len = recv_line(sock, buf, sizeof(buf), tmo)) >= 0)
 	if (len > 0)
@@ -585,7 +587,7 @@ if (!malware_ok)
 	{
 	/* calc file size */
 	if ((drweb_fd = open(CCS eml_filename, O_RDONLY)) == -1)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't open spool file %s: %s",
 	      eml_filename, strerror(errno)),
 	    sock);
@@ -594,7 +596,7 @@ if (!malware_ok)
 	  {
 	  int err = errno;
 	  (void)close(drweb_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't seek spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -603,7 +605,7 @@ if (!malware_ok)
 	if ((off_t)fsize_uint != fsize)
 	  {
 	  (void)close(drweb_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("seeking spool file %s, size overflow",
 	      eml_filename),
 	    sock);
@@ -621,7 +623,7 @@ if (!malware_ok)
 	    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
 	  {
 	  (void)close(drweb_fd);
-	  return m_errlog_defer_3(scanent, string_sprintf(
+	  return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
 	    "unable to send commands to socket (%s)", scanner_options),
 	    sock);
 	  }
@@ -629,7 +631,7 @@ if (!malware_ok)
 	if (!(drweb_fbuf = (uschar *) malloc (fsize_uint)))
 	  {
 	  (void)close(drweb_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("unable to allocate memory %u for file (%s)",
 	      fsize_uint, eml_filename),
 	    sock);
@@ -640,7 +642,7 @@ if (!malware_ok)
 	  int err = errno;
 	  (void)close(drweb_fd);
 	  free(drweb_fbuf);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't read spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -651,7 +653,7 @@ if (!malware_ok)
 	if (send(sock, drweb_fbuf, fsize, 0) < 0)
 	  {
 	  free(drweb_fbuf);
-	  return m_errlog_defer_3(scanent, string_sprintf(
+	  return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
 	    "unable to send file body to socket (%s)", scanner_options),
 	    sock);
 	  }
@@ -670,19 +672,19 @@ if (!malware_ok)
 	    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
 	    (send(sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
 	    (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
-	  return m_errlog_defer_3(scanent, string_sprintf(
+	  return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
 	    "unable to send commands to socket (%s)", scanner_options),
 	    sock);
 	}
 
       /* wait for result */
       if (!recv_len(sock, &drweb_rc, sizeof(drweb_rc), tmo))
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 		    US"unable to read return code", sock);
       drweb_rc = ntohl(drweb_rc);
 
       if (!recv_len(sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 			    US"unable to read the number of viruses", sock);
       drweb_vnum = ntohl(drweb_vnum);
 
@@ -704,14 +706,14 @@ if (!malware_ok)
 	  int size = 0, off = 0, ovector[10*3];
 	  /* read the size of report */
 	  if (!recv_len(sock, &drweb_slen, sizeof(drweb_slen), tmo))
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, CUS callout_address,
 			      US"cannot read report size", sock);
 	  drweb_slen = ntohl(drweb_slen);
 	  tmpbuf = store_get(drweb_slen);
 
 	  /* read report body */
 	  if (!recv_len(sock, tmpbuf, drweb_slen, tmo))
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, CUS callout_address,
 			      US"cannot read report string", sock);
 	  tmpbuf[drweb_slen] = '\0';
 
@@ -749,7 +751,7 @@ if (!malware_ok)
 	 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
 	 * and others are ignored */
 	if (drweb_s)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
 	    sock);
 
@@ -769,7 +771,7 @@ if (!malware_ok)
       recv_line(sock, buf, sizeof(buf), tmo);
 
       if (buf[0] != '2')		/* aveserver is having problems */
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unavailable (Responded: %s).",
 			  ((buf[0] != 0) ? buf : (uschar *)"nothing") ),
 	  sock);
@@ -782,7 +784,7 @@ if (!malware_ok)
       DEBUG(D_acl) debug_printf("Malware scan: issuing %s %s\n",
 	scanner_name, buf);
       if (m_sock_send(sock, buf, Ustrlen(buf), &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       malware_name = NULL;
       result = 0;
@@ -793,7 +795,7 @@ if (!malware_ok)
 	  break;
 	if (buf[0] == '5')		/* aveserver is having problems */
 	  {
-	  result = m_errlog_defer(scanent,
+	  result = m_errlog_defer(scanent, CUS callout_address,
 	     string_sprintf("unable to scan file %s (Responded: %s).",
 			     eml_filename, buf));
 	  break;
@@ -807,14 +809,14 @@ if (!malware_ok)
 	}
 
       if (m_sock_send(sock, US"quit\r\n", 6, &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       /* read aveserver's greeting and see if it is ready (2xx greeting) */
       buf[0] = 0;
       recv_line(sock, buf, sizeof(buf), tmo);
 
       if (buf[0] != '2')		/* aveserver is having problems */
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unable to quit dialogue (Responded: %s).",
 			((buf[0] != 0) ? buf : (uschar *)"nothing") ),
 	  sock);
@@ -847,12 +849,12 @@ if (!malware_ok)
 	{
 
 	if (m_sock_send(sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
-	  return m_errlog_defer(scanent, errstr);
+	  return m_errlog_defer(scanent, CUS callout_address, errstr);
 
 	bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
 	if (bread > 0) av_buffer[bread]='\0';
 	if (bread < 0)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("unable to read answer %d (%s)", i, strerror(errno)),
 	    sock);
 	for (j = 0; j < bread; j++)
@@ -864,7 +866,7 @@ if (!malware_ok)
       file_name = string_sprintf("SCAN\t%s\n", eml_filename);
 
       if (m_sock_send(sock, file_name, Ustrlen(file_name), &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       /* set up match */
       /* todo also SUSPICION\t */
@@ -882,7 +884,7 @@ if (!malware_ok)
 	  errno = ETIMEDOUT;
 	  i =  av_buffer+sizeof(av_buffer)-p;
 	  if ((bread= ip_recv(sock, p, i-1, tmo-time(NULL))) < 0)
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, CUS callout_address,
 	      string_sprintf("unable to read result (%s)", strerror(errno)),
 	      sock);
 
@@ -939,11 +941,11 @@ if (!malware_ok)
 
       /* send scan request */
       if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       /* wait for result */
       if (!recv_len(sock, tmpbuf, 2, tmo))
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 			    US"unable to read 2 bytes from socket.", sock);
 
       /* get errorcode from one nibble */
@@ -951,14 +953,14 @@ if (!malware_ok)
       switch(kav_rc)
       {
       case 5: case 6: /* improper kavdaemon configuration */
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 		US"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
 		sock);
       case 1:
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 		US"reported 'scanning not completed' (code 1).", sock);
       case 7:
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 		US"reported 'kavdaemon damaged' (code 7).", sock);
       }
 
@@ -980,7 +982,7 @@ if (!malware_ok)
 	  {
 	  /* read report size */
 	  if (!recv_len(sock, &kav_reportlen, 4, tmo))
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, CUS callout_address,
 		  US"cannot read report size", sock);
 
 	  /* it's possible that avp returns av_buffer[1] == 1 but the
@@ -1037,19 +1039,19 @@ if (!malware_ok)
       uschar *p;
 
       if (!cmdline_scanner)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, NULL, errstr);
 
       /* find scanner output trigger */
       cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
 				"missing trigger specification", &errstr);
       if (!cmdline_trigger_re)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, NULL, errstr);
 
       /* find scanner name regex */
       cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
 			  "missing virus name regex specification", &errstr);
       if (!cmdline_regex_re)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, NULL, errstr);
 
       /* prepare scanner call; despite the naming, file_name holds a directory
       name which is documented as the value given to %s. */
@@ -1074,7 +1076,7 @@ if (!malware_ok)
 	{
 	int err = errno;
 	signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, NULL,
 	  string_sprintf("call (%s) failed: %s.", commandline, strerror(err)));
 	}
       scanner_fd = fileno(scanner_out);
@@ -1087,7 +1089,7 @@ if (!malware_ok)
 	int err = errno;
 	(void) pclose(scanner_out);
 	signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
-	return m_errlog_defer(scanent, string_sprintf(
+	return m_errlog_defer(scanent, NULL, string_sprintf(
 	    "opening scanner output file (%s) failed: %s.",
 	    file_name, strerror(err)));
 	}
@@ -1103,7 +1105,7 @@ if (!malware_ok)
 	    break;
 	  (void) pclose(scanner_out);
 	  signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
-	  return m_errlog_defer(scanent, string_sprintf(
+	  return m_errlog_defer(scanent, NULL, string_sprintf(
 	      "unable to read from scanner (%s): %s",
 	      commandline, strerror(err)));
 	  }
@@ -1113,7 +1115,7 @@ if (!malware_ok)
 	  /* short write */
 	  (void) pclose(scanner_out);
 	  signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
-	  return m_errlog_defer(scanent, string_sprintf(
+	  return m_errlog_defer(scanent, NULL, string_sprintf(
 	    "short write on scanner output file (%s).", file_name));
 	  }
 	putc('\n', scanner_record);
@@ -1128,7 +1130,7 @@ if (!malware_ok)
       sep = pclose(scanner_out);
       signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
       if (sep != 0)
-	  return m_errlog_defer(scanent,
+	  return m_errlog_defer(scanent, NULL, 
 	      sep == -1
 	      ? string_sprintf("running scanner failed: %s", strerror(sep))
 	      : string_sprintf("scanner returned error code: %d", sep));
@@ -1172,14 +1174,14 @@ if (!malware_ok)
       if (  write(sock, file_name, Ustrlen(file_name)) < 0
 	 || write(sock, "\n", 1) != 1
 	 )
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unable to write to UNIX socket (%s)", scanner_options),
 	  sock);
 
       /* wait for result */
       memset(av_buffer, 0, sizeof(av_buffer));
       if ((bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL))) <= 0)
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unable to read from UNIX socket (%s)", scanner_options),
 	  sock);
 
@@ -1191,7 +1193,8 @@ if (!malware_ok)
 	malware_name = string_copy(&av_buffer[2]);
       }
       else if (!strncmp(CS av_buffer, "-1", 2))
-	return m_errlog_defer_3(scanent, US"scanner reported error", sock);
+	return m_errlog_defer_3(scanent, CUS callout_address,
+		US"scanner reported error", sock);
       else /* all ok, no virus */
 	malware_name = NULL;
 
@@ -1253,7 +1256,7 @@ if (!malware_ok)
 
 	/* parse options */
 	if (clamd_option(cd, sublist, &subsep) != OK)
-	  return m_errlog_defer(scanent,
+	  return m_errlog_defer(scanent, NULL,
 	    string_sprintf("bad option '%s'", scanner_options));
 	cv[0] = cd;
 	}
@@ -1285,13 +1288,13 @@ if (!malware_ok)
 	  sublist = scanner_options;
 	  if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0)))
 	    {
-	    (void) m_errlog_defer(scanent,
+	    (void) m_errlog_defer(scanent, NULL, 
 		      string_sprintf("missing address: '%s'", scanner_options));
 	    continue;
 	    }
 	  if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0)))
 	    {
-	    (void) m_errlog_defer(scanent,
+	    (void) m_errlog_defer(scanent, NULL, 
 		      string_sprintf("missing port: '%s'", scanner_options));
 	    continue;
 	    }
@@ -1301,7 +1304,7 @@ if (!malware_ok)
 	  /*XXX should these options be common over scanner types? */
 	  if (clamd_option(cd, sublist, &subsep) != OK)
 	    {
-	    return m_errlog_defer(scanent,
+	    return m_errlog_defer(scanent, NULL,
 	      string_sprintf("bad option '%s'", scanner_options));
 	    continue;
 	    }
@@ -1309,7 +1312,7 @@ if (!malware_ok)
 	  cv[num_servers++] = cd;
 	  if (num_servers >= MAX_CLAMD_SERVERS)
 	    {
-	    (void) m_errlog_defer(scanent,
+	    (void) m_errlog_defer(scanent, NULL,
 		  US"More than " MAX_CLAMD_SERVERS_S " clamd servers "
 		  "specified; only using the first " MAX_CLAMD_SERVERS_S );
 	    break;
@@ -1319,14 +1322,14 @@ if (!malware_ok)
 
 	/* check if we have at least one server */
 	if (!num_servers)
-	  return m_errlog_defer(scanent,
+	  return m_errlog_defer(scanent, NULL,
 	    US"no useable server addresses in malware configuration option.");
 	}
 
       /* See the discussion of response formats below to see why we really
       don't like colons in filenames when passing filenames to ClamAV. */
       if (use_scan_command && Ustrchr(eml_filename, ':'))
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, NULL,
 	  string_sprintf("local/SCAN mode incompatible with" \
 	    " : in path to email filename [%s]", eml_filename));
 
@@ -1362,8 +1365,7 @@ if (!malware_ok)
 	  if (sock >= 0)
 	    break;
 
-	  log_write(0, LOG_MAIN, "malware acl condition: %s: %s",
-	    scanent->name, errstr);
+	  (void) m_errlog_defer(scanent, CUS callout_address, errstr);
 
 	  /* Remove the server from the list. XXX We should free the memory */
 	  num_servers--;
@@ -1372,7 +1374,7 @@ if (!malware_ok)
 	  }
 
 	if (num_servers == 0)
-	  return m_errlog_defer(scanent, US"all servers failed");
+	  return m_errlog_defer(scanent, NULL, US"all servers failed");
 	}
       else
 	for (;;)
@@ -1383,7 +1385,7 @@ if (!malware_ok)
 	    break;
 	    }
 	  if (cv[0]->retry <= 0)
-	    return m_errlog_defer(scanent, errstr);
+	    return m_errlog_defer(scanent, CUS callout_address, errstr);
 	  while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry);
 	  }
 
@@ -1405,33 +1407,35 @@ if (!malware_ok)
 
 	/* Pass the string to ClamAV (7 = "STREAM\n") */
 	if (m_sock_send(sock, US"STREAM\n", 7, &errstr) < 0)
-	  return m_errlog_defer(scanent, errstr);
+	  return m_errlog_defer(scanent, CUS callout_address, errstr);
 
 	memset(av_buffer2, 0, sizeof(av_buffer2));
 	bread = ip_recv(sock, av_buffer2, sizeof(av_buffer2), tmo-time(NULL));
 
 	if (bread < 0)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("unable to read PORT from socket (%s)",
 		strerror(errno)),
 	    sock);
 
 	if (bread == sizeof(av_buffer2))
-	  return m_errlog_defer_3(scanent, "buffer too small", sock);
+	  return m_errlog_defer_3(scanent, CUS callout_address,
+		  "buffer too small", sock);
 
 	if (!(*av_buffer2))
-	  return m_errlog_defer_3(scanent, "ClamAV returned null", sock);
+	  return m_errlog_defer_3(scanent, CUS callout_address,
+		  "ClamAV returned null", sock);
 
 	av_buffer2[bread] = '\0';
 	if( sscanf(CS av_buffer2, "PORT %u\n", &port) != 1 )
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("Expected port information from clamd, got '%s'",
 	      av_buffer2),
 	    sock);
 
 	sockData = m_tcpsocket(connhost.address, port, NULL, &errstr);
 	if (sockData < 0)
-	  return m_errlog_defer_3(scanent, errstr, sock);
+	  return m_errlog_defer_3(scanent, CUS callout_address, errstr, sock);
 
 # define CLOSE_SOCKDATA (void)close(sockData)
 #else /* WITH_OLD_CLAMAV_STREAM not defined */
@@ -1445,7 +1449,7 @@ if (!malware_ok)
 
 	/* Pass the string to ClamAV (10 = "zINSTREAM\0") */
 	if (send(sock, "zINSTREAM", 10, 0) < 0)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS hostname,
 	    string_sprintf("unable to send zINSTREAM to socket (%s)",
 	      strerror(errno)),
 	    sock);
@@ -1458,7 +1462,7 @@ if (!malware_ok)
 	  {
 	  int err = errno;
 	  CLOSE_SOCKDATA;
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't open spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -1467,7 +1471,7 @@ if (!malware_ok)
 	  {
 	  int err = errno;
 	  CLOSE_SOCKDATA; (void)close(clam_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't seek spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -1476,7 +1480,7 @@ if (!malware_ok)
 	if ((off_t)fsize_uint != fsize)
 	  {
 	  CLOSE_SOCKDATA; (void)close(clam_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("seeking spool file %s, size overflow",
 	      eml_filename),
 	    sock);
@@ -1486,7 +1490,7 @@ if (!malware_ok)
 	if (!(clamav_fbuf = (uschar *) malloc (fsize_uint)))
 	  {
 	  CLOSE_SOCKDATA; (void)close(clam_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("unable to allocate memory %u for file (%s)",
 	      fsize_uint, eml_filename),
 	    sock);
@@ -1496,7 +1500,7 @@ if (!malware_ok)
 	  {
 	  int err = errno;
 	  free(clamav_fbuf); CLOSE_SOCKDATA; (void)close(clam_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't read spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -1508,7 +1512,7 @@ if (!malware_ok)
 	if (send(sockData, clamav_fbuf, fsize_uint, 0) < 0)
 	  {
 	  free(clamav_fbuf); CLOSE_SOCKDATA;
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("unable to send file body to socket (%s:%u)",
 	      hostname, port),
 	    sock);
@@ -1521,7 +1525,7 @@ if (!malware_ok)
 	    (send(sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0))
 	  {
 	  free(clamav_fbuf);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("unable to send file body to socket (%s)", hostname),
 	    sock);
 	  }
@@ -1555,7 +1559,7 @@ if (!malware_ok)
 	    scanner_name, scanner_options);
 
 	if (send(sock, file_name, Ustrlen(file_name), 0) < 0)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("unable to write to socket (%s)", strerror(errno)),
 	    sock);
 
@@ -1572,12 +1576,13 @@ if (!malware_ok)
       sock = -1;
 
       if (bread <= 0)
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, CUS callout_address,
 	  string_sprintf("unable to read from socket (%s)",
 	  errno == 0 ? "EOF" : strerror(errno)));
 
       if (bread == sizeof(av_buffer))
-	return m_errlog_defer(scanent, US"buffer too small");
+	return m_errlog_defer(scanent, CUS callout_address,
+		US"buffer too small");
       /* We're now assured of a NULL at the end of av_buffer */
 
       /* Check the result. ClamAV returns one of two result formats.
@@ -1601,7 +1606,8 @@ if (!malware_ok)
       passing a filename to clamd). */
 
       if (!(*av_buffer))
-	return m_errlog_defer(scanent, US"ClamAV returned null");
+	return m_errlog_defer(scanent, CUS callout_address,
+		US"ClamAV returned null");
 
       /* strip newline at the end (won't be present for zINSTREAM)
       (also any trailing whitespace, which shouldn't exist, but we depend upon
@@ -1617,7 +1623,7 @@ if (!malware_ok)
 
       /* colon in returned output? */
       if(!(p = Ustrchr(av_buffer,':')))
-	return m_errlog_defer(scanent, string_sprintf(
+	return m_errlog_defer(scanent, CUS callout_address, string_sprintf(
 		  "ClamAV returned malformed result (missing colon): %s",
 		  av_buffer));
 
@@ -1650,7 +1656,7 @@ if (!malware_ok)
 
 	}
       else if (Ustrcmp(result_tag, "ERROR") == 0)
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, CUS callout_address,
 	  string_sprintf("ClamAV returned: %s", av_buffer));
 
       else if (Ustrcmp(result_tag, "OK") == 0)
@@ -1661,7 +1667,7 @@ if (!malware_ok)
 
 	}
       else
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, CUS callout_address,
 	  string_sprintf("unparseable response from ClamAV: {%s}", av_buffer));
 
       break;
@@ -1688,7 +1694,7 @@ if (!malware_ok)
 	uschar * s = Ustrchr(sockline_scanner, '%');
 	if (s++)
 	  if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%'))
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, NULL,
 				  US"unsafe sock scanner call spec", sock);
       }
       else
@@ -1698,13 +1704,13 @@ if (!malware_ok)
       sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
 				"missing trigger specification", &errstr);
       if (!sockline_trig_re)
-	return m_errlog_defer_3(scanent, errstr, sock);
+	return m_errlog_defer_3(scanent, NULL, errstr, sock);
 
       /* find virus name regex */
       sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
 			  "missing virus name regex specification", &errstr);
       if (!sockline_name_re)
-	return m_errlog_defer_3(scanent, errstr, sock);
+	return m_errlog_defer_3(scanent, NULL, errstr, sock);
 
       /* prepare scanner call - security depends on expansions check above */
       commandline = string_sprintf("%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
@@ -1713,18 +1719,19 @@ if (!malware_ok)
 
       /* Pass the command string to the socket */
       if (m_sock_send(sock, commandline, Ustrlen(commandline), &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       /* Read the result */
       bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
 
       if (bread <= 0)
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unable to read from socket (%s)", strerror(errno)),
 	  sock);
 
       if (bread == sizeof(av_buffer))
-	return m_errlog_defer_3(scanent, US"buffer too small", sock);
+	return m_errlog_defer_3(scanent, CUS callout_address,
+		US"buffer too small", sock);
       av_buffer[bread] = '\0';
       linebuffer = string_copy(av_buffer);
 
@@ -1753,12 +1760,12 @@ if (!malware_ok)
 	   || mksd_maxproc < 1
 	   || mksd_maxproc > 32
 	   )
-	  return m_errlog_defer(scanent,
+	  return m_errlog_defer(scanent, CUS callout_address,
 	    string_sprintf("invalid option '%s'", scanner_options));
 	}
 
       if((sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       malware_name = NULL;
 
@@ -1840,7 +1847,7 @@ if (!malware_ok)
 	      if (send(sock, scanrequest, len, 0) < 0)
 		{
 		scanrequest[len-1] = '\0';
-		return m_errlog_defer_3(scanent, string_sprintf(
+		return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
 		      "unable to send request '%s' to socket (%s): %s",
 		      scanrequest, scanner_options, strerror(errno)), sock);
 		}
@@ -1869,7 +1876,8 @@ if (!malware_ok)
 	      if (Ustrncmp(buf, "200 SCAN OK", 11) == 0)
 		{ /* we're done finally */
 		if (send(sock, "QUIT\n", 5, 0) < 0) /* courtesy */
-		  return m_errlog_defer_3(scanent, string_sprintf(
+		  return m_errlog_defer_3(scanent, CUS callout_address,
+			  string_sprintf(
 			      "unable to send quit request to socket (%s): %s",
 			      scanner_options, strerror(errno)),
 			      sock);
@@ -1892,7 +1900,7 @@ if (!malware_ok)
 	{
 	case AVA_HELO:
 	case AVA_OPT:
-	case AVA_RSP:	return m_errlog_defer_3(scanent,
+	case AVA_RSP:	return m_errlog_defer_3(scanent, CUS callout_address,
 			    nread >= 0
 			    ? string_sprintf(
 				"invalid response from scanner: '%s'", buf)
diff --git a/src/src/spam.c b/src/src/spam.c
index 118fcfa8a..6a0ca3c20 100644
--- a/src/src/spam.c
+++ b/src/src/spam.c
@@ -414,7 +414,7 @@ if (wrote == -1)
   {
   (void)close(spamd_sock);
   log_write(0, LOG_MAIN|LOG_PANIC,
-       "%s spamd send failed: %s", loglabel, strerror(errno));
+       "%s spamd %s send failed: %s", loglabel, callout_address, strerror(errno));
   goto defer;
   }
 
@@ -459,13 +459,13 @@ again:
       {
       if (result == -1)
 	log_write(0, LOG_MAIN|LOG_PANIC,
-	  "%s %s on spamd socket", loglabel, strerror(errno));
+	  "%s %s on spamd %s socket", loglabel, callout_address, strerror(errno));
       else
 	{
 	if (time(NULL) - start < sd->timeout)
 	  goto again;
 	log_write(0, LOG_MAIN|LOG_PANIC,
-	  "%s timed out writing spamd socket", loglabel);
+	  "%s timed out writing spamd %s, socket", loglabel, callout_address);
 	}
       (void)close(spamd_sock);
       goto defer;
@@ -475,7 +475,7 @@ again:
     if (wrote == -1)
       {
       log_write(0, LOG_MAIN|LOG_PANIC,
-	  "%s %s on spamd socket", loglabel, strerror(errno));
+	  "%s %s on spamd %s socket", loglabel, callout_address, strerror(errno));
       (void)close(spamd_sock);
       goto defer;
       }
@@ -514,7 +514,7 @@ while ((i = ip_recv(spamd_sock,
 if (i <= 0 && errno != 0)
   {
   log_write(0, LOG_MAIN|LOG_PANIC,
-       "%s error reading from spamd socket: %s", loglabel, strerror(errno));
+       "%s error reading from spamd %s, socket: %s", loglabel, callout_address, strerror(errno));
   (void)close(spamd_sock);
   return DEFER;
   }
@@ -531,7 +531,7 @@ if (sd->is_rspamd)
 	  &spamd_reject_score, &spamd_report_offset)) != 5)
     {
     log_write(0, LOG_MAIN|LOG_PANIC,
-	      "%s cannot parse spamd output: %d", loglabel, r);
+	      "%s cannot parse spamd %s, output: %d", loglabel, callout_address, r);
     return DEFER;
     }
   /* now parse action */
@@ -560,7 +560,7 @@ else
 	   spamd_version,&spamd_score,&spamd_threshold,&spamd_report_offset) != 3)
 	{
 	log_write(0, LOG_MAIN|LOG_PANIC,
-		  "%s cannot parse spamd output", loglabel);
+		  "%s cannot parse spamd %s output", loglabel, callout_address);
 	return DEFER;
 	}
     }
diff --git a/test/log/4002 b/test/log/4002
index d60fa4e09..ee008a250 100644
--- a/test/log/4002
+++ b/test/log/4002
@@ -1,17 +1,17 @@
 1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
 1999-03-02 09:44:33 10HmbD-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver: unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 1999-03-02 09:44:33 10HmbB-0005vi-00 malware_name VNAME
 1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver: unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
 1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver: unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver: unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="accept this, overriding the scan daemon temp-error"
 1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
diff --git a/test/log/4003 b/test/log/4003
index ad916571e..cfdd01805 100644
--- a/test/log/4003
+++ b/test/log/4003
@@ -3,9 +3,9 @@
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name VNAME
 1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: fsecure: unable to read answer 0 (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: fsecure: unable to read answer 0 (Connection timed out)
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4004 b/test/log/4004
index 1929e96a0..28cbd960e 100644
--- a/test/log/4004
+++ b/test/log/4004
@@ -1,13 +1,13 @@
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
 1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie: scanner reported error
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : scanner reported error
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
 1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie: unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
 1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie: unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted destpite timeout"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
diff --git a/test/log/4005 b/test/log/4005
index 821bed132..33f47f90e 100644
--- a/test/log/4005
+++ b/test/log/4005
@@ -1,13 +1,13 @@
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
 1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd: ClamAV returned: scanned_file_name: 666 ERROR
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : ClamAV returned: scanned_file_name: 666 ERROR
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
 1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd: unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
 1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd: unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="accept this one despite timeout"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
diff --git a/test/log/4006 b/test/log/4006
index ccdd53595..bd0ec8720 100644
--- a/test/log/4006
+++ b/test/log/4006
@@ -1,13 +1,13 @@
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
 1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast: invalid response from scanner: 'blah	[E]'
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
 1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast: timeout from scanner
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
 1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast: timeout from scanner
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
diff --git a/test/log/4007 b/test/log/4007
index f78b4be3a..057a436ee 100644
--- a/test/log/4007
+++ b/test/log/4007
@@ -3,9 +3,9 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name VNAME
 1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline: unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline: unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite a timeout"
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/paniclog/4002 b/test/paniclog/4002
index 8d6b6f1c4..a6521b25e 100644
--- a/test/paniclog/4002
+++ b/test/paniclog/4002
@@ -1,4 +1,4 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver: unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver: unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver: unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver: unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
diff --git a/test/paniclog/4003 b/test/paniclog/4003
index aff2aff3f..0efd096fb 100644
--- a/test/paniclog/4003
+++ b/test/paniclog/4003
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: fsecure: unable to read answer 0 (Connection timed out)
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: fsecure: unable to read answer 0 (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
diff --git a/test/paniclog/4004 b/test/paniclog/4004
index 3a5b4eceb..1de0ab5aa 100644
--- a/test/paniclog/4004
+++ b/test/paniclog/4004
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie: scanner reported error
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie: unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie: unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : scanner reported error
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
diff --git a/test/paniclog/4005 b/test/paniclog/4005
index dbaf01e3a..adfca5304 100644
--- a/test/paniclog/4005
+++ b/test/paniclog/4005
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd: ClamAV returned: scanned_file_name: 666 ERROR
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd: unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd: unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : ClamAV returned: scanned_file_name: 666 ERROR
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
diff --git a/test/paniclog/4006 b/test/paniclog/4006
index 19caa79fe..5236f07f2 100644
--- a/test/paniclog/4006
+++ b/test/paniclog/4006
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast: invalid response from scanner: 'blah	[E]'
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast: timeout from scanner
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast: timeout from scanner
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
diff --git a/test/paniclog/4007 b/test/paniclog/4007
index 156815be5..ece05e2cb 100644
--- a/test/paniclog/4007
+++ b/test/paniclog/4007
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline: unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline: unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
diff --git a/test/stderr/4002 b/test/stderr/4002
index 8d6b6f1c4..a6521b25e 100644
--- a/test/stderr/4002
+++ b/test/stderr/4002
@@ -1,4 +1,4 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver: unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver: unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver: unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver: unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
diff --git a/test/stderr/4003 b/test/stderr/4003
index aff2aff3f..0efd096fb 100644
--- a/test/stderr/4003
+++ b/test/stderr/4003
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: fsecure: unable to read answer 0 (Connection timed out)
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: fsecure: unable to read answer 0 (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
diff --git a/test/stderr/4004 b/test/stderr/4004
index 3a5b4eceb..1de0ab5aa 100644
--- a/test/stderr/4004
+++ b/test/stderr/4004
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie: scanner reported error
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie: unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie: unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : scanner reported error
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
diff --git a/test/stderr/4005 b/test/stderr/4005
index dbaf01e3a..adfca5304 100644
--- a/test/stderr/4005
+++ b/test/stderr/4005
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd: ClamAV returned: scanned_file_name: 666 ERROR
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd: unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd: unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : ClamAV returned: scanned_file_name: 666 ERROR
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
diff --git a/test/stderr/4006 b/test/stderr/4006
index 19caa79fe..5236f07f2 100644
--- a/test/stderr/4006
+++ b/test/stderr/4006
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast: invalid response from scanner: 'blah	[E]'
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast: timeout from scanner
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast: timeout from scanner
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
diff --git a/test/stderr/4007 b/test/stderr/4007
index 156815be5..ece05e2cb 100644
--- a/test/stderr/4007
+++ b/test/stderr/4007
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline: unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline: unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out