On Thu, 4 Dec 2003 13:27 , McKeever Chris <[EMAIL PROTECTED]> sent:
>
>>>On Thu, 2003-12-04 at 04:03, McKeever Chris wrote:
>>>> I am running qmail-scanner with clamav (0.65)
>>>> I have one machine that acts as a gateway, and then sends it to the main email
>>>> server.
>>>> The gateway is the one with qmailscanner and clamav, the email servers post-MTA
>>>> (@mail) has a plugin for clamav which scans the file
>>before
>>>> databsing it.
>>>>
>>>> I have noticed since 11/4/03 that there are about 2-4 emails per day that get by
>>>> the gateway and picked up by the @mail-clamav scan
>>>> any suggestions? They are typically Exploit.IFrame.Gen and 1 W32/Yaha.g.dam
>>>>
>>>
>>>Are you running clamscan or clamdscan? (i.e. the daemon version). I bet
>>>it's the latter.
>>>
>>>Do you have the qmail-queue.log debug file that contains evidence of
>>>such a "missed" message? If not, turn it on and don't stop logging until
>>>you catch another such occurance. Then you can search that file looking
>>>for the particular message that "slipped through". At that stage you may
>>>see why it failed. I'd suspect a bug whereby clamd failed to scan the
>>>message for some transitory reason, but still exited with a zero error
>>>status - so Qmail-Scanner can only assume it's OK and carried on.
>>>
>>>Let us know what you find.
>>
>>
>>Ok, I must being something wrong, here is the log file since getting v1.20 up and
>>running:
>>
>> run /usr/local/bin/clamdscan -r --disable-summary --max-recursion=10
>> --max-space=1000000 /var/spool/qmailscan/tmp/prupref-
>>mailgate107056485446118269 2>&1
>>Thu, 04 Dec 2003 13:07:34 -0600:18269: --output of clamuko was:
>>connect(): No such file or directory
>>ERROR: Can't connect to clamd.
>>--
>>04/12/2003 13:07:34:18269: error_condition: X-Qmail-Scanner-1.20: clamuko: corrupt
>>or unknown clamd scanner error or
>>memory/resource/perms problem - exit status 2
>>
>>there is never anything in that directory.
>>
>
>Looking at my 1.16 script, I noticed that I was not running clamukp (which is what it
>defaulted to in 1.20) I edited
>my @scanner_array=("clamscan_scanner");
>
>and now I get this error:
>
>X-Qmail-Scanner-1.20: Requeuing: Undefined subroutine &main::clamscan_scanner called
>at bin/qmail-queue line 1151.
>
>so I am all confused
>
recompiled, this time opting just for clamscan...now the logs look clean, will monitor
for the one that 'slip' by,
Now..just out of obsessive compulsion, any idea why I am getting the error using
clamuko?
>> run /usr/local/bin/clamdscan -r --disable-summary --max-recursion=10
>> --max-space=1000000 /var/spool/qmailscan/tmp/prupref-
>>mailgate107056485446118269 2>&1
>>Thu, 04 Dec 2003 13:07:34 -0600:18269: --output of clamuko was:
>>connect(): No such file or directory
>>ERROR: Can't connect to clamd.
>>--
>>04/12/2003 13:07:34:18269: error_condition: X-Qmail-Scanner-1.20: clamuko: corrupt
>>or unknown clamd scanner error or
>>memory/resource/perms problem - exit status 2
-------------------------------------------
Chris McKeever
If you want to reply directly to me, please use cgmckeever--at--prupref---dot---com
http://www.prupref.com
---- Prudential Preferred Properties www.prupref.com
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Qmail-scanner-general mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
