Thanks. that resolved it.
On 09/01/2010 00:18, Drew Balfour wrote:
Comparing the snoop from nvscan to the snoop from icap-client the
options are different. If I use the same options to icap-client then it
will also fail to find the virus. Seems to be a problem with the c-icap
server.
$ /opt/cjgsw/bin/icap\-client -f virus.d/clam.pdf -s "avscan"
ICAP server:localhost, ip:127.0.0.1, port:1344
No modification needed (Allow 204 response)
$
I'll take it up with the c-icap people.
Sorry I didn't see this sooner; it's probably your c-icap configuration.
Assuming you didn't change these:
ServiceAlias avscan srv_clamav?allow204=on&sizelimit=off&mode=simple
srv_clamav.ScanFileTypes TEXT DATA EXECUTABLE ARCHIVE GIF JPEG MSOFFICE
Then c-icapd won't scan the PDF file, unless you force it to.
This is why:
% /opt/cjgsw/bin/icap\-client -f clam.pdf -s
"srv_clamav?allow204=on&force=on&sizelimit=off&mode=simple"
Finds it, but
% /opt/cjgsw/bin/icap\-client -f clam.pdf -s "avscan"
doesn't.
So zfs/vscan is trying to scan clam.pdf, but the c-icapd doesn't want to.
Throw PDF on the end of srv_clamav.ScanFileTypes if you want it to
auto-magically scan PDFs:
%grep PDF /usr/local/etc/c-icap.conf
srv_clamav.ScanFileTypes TEXT DATA EXECUTABLE ARCHIVE GIF JPEG MSOFFICE PDF
% /usr/local/bin/icap-client -f clam.pdf -s "avscan" | grep VIRUS
ICAP server:localhost, ip:127.0.0.1, port:1344
<H1>VIRUS FOUND</H1>
%
-Drew
_______________________________________________
cifs-discuss mailing list
[email protected]
http://mail.opensolaris.org/mailman/listinfo/cifs-discuss
--
Sent from my OpenSolaris Laptop
_______________________________________________
cifs-discuss mailing list
[email protected]
http://mail.opensolaris.org/mailman/listinfo/cifs-discuss
