Mark Martinec wrote:
> See what ended up in the .../parts directory by turning on
> per-recipient debugging, e.g.:
> 
>   @debug_sender_maps = ( ['yours...@example.com'] );
> 
> Apart from turning on full logging for a message to the specified
> recipient address, it will also retain the contents of a temporary
> directory, so you will be able to check what exactly is there.
> The directory location will be logged, e.g.:
> 
> PRESERVING EVIDENCE in /var/amavis/amavis-20090624T233048-45480
> 
>   Mark

Ah, thanks. This is what I needed. Amavis is presenting the full message 
to ClamAV as expected.

This particular message begins with a "Received-SPF:" header. For some 
reason, this causes ClamAV to miss the signature. Removal of the header 
results in the expected behavior.

The second test signature (the one that's failing) is defined for file 
type 4, or "Mail file," according to [2]. If I had to guess, it would be 
that the "Received-SPF" header is throwing off ClamAV's mail file detection.

I'll take it to the ClamAV list. Thanks again.


[2] http://clamav.net/doc/latest/signatures.pdf


------------------------------------------------------------------------------
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net 
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/ 

Reply via email to