In my exim4 installation I keep getting both UTF-8 encoded and extended ANSI encoded mainlog containing strings like "tämä" (correctly in UTF-8) and "t\xe4\m\xe4" (ANSI). The latter escaped markings are one-byte codes, escaping done for clarity ("tämä" encoded as 74 EC 6D EC in bytes). Today's default, of course, is UTF-8 and most of the lines are just ok.
The problem is that this confuses fail2ban because it expects the log file to be encoded in a coherent manner. I cannot, however, select either ANSI or UTF-8 because both encodings exist in the log file.
I wonder if there a way to filter out the ANSI characters before logging the strings to /var/log/exim/mainlog?
As for the culprit it might be an ancient piece of spamming software on a Windows machine or some old mass mailing application. Anyhow, roughly 35-45% of the log lines seem to be contaminated with ANSI on a daily basis.
