-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Robert Blayzor
Sent: maandag 7 maart 2005 15:39
To: ClamAV users ML
Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
I'll give it a whirl, and yes, I seem to have it trapping
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd Lyons
Sent: dinsdag 8 maart 2005 0:23
To: 'ClamAV users ML'
Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
Mark wanted us to know:
Yesterday, I subjected ClamAV
On Fri, 2005-03-04 at 11:59 -0500, Robert Blayzor wrote:
Trog wrote:
What software are you using to do stream scanning? It is switched off by
default in clamav-milter 0.83
I'm using a PERL script that is taking the messages and stream scanning
them with clamd. It's been running fine
[EMAIL PROTECTED] said:
I can also not say I understand why ClamAV would hang on STREAM, and not on
SCAN
Your STREAM problem may be different of course.
The messages that gave our clamd a hard time would do exactly the same for
clamscan ( of course ). I just wanted you to check that you
Trog wrote:
You can't send multiple commands. You *must* follow the following
sequence:
send: SESSION
pause
send: SCAN /my/file
read reply
send: SCAN /my/file2
read reply
What's pause supposed to mean?
___
On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
Trog wrote:
You can't send multiple commands. You *must* follow the following
sequence:
send: SESSION
pause
send: SCAN /my/file
read reply
send: SCAN /my/file2
read reply
What's pause supposed to mean?
pause
n.
On Monday 07 Mar 2005 12:08, Julian Mehnle wrote:
Trog wrote:
send: SESSION
pause
What's pause supposed to mean?
From my dictionary:
pause: interval of inaction or silence; break made in speech or
reading.
Mind you my dictionary was written before the days of the Internet.
--
Nigel
Trog wrote:
On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
Trog wrote:
You can't send multiple commands. You *must* follow the following
sequence:
send: SESSION
pause
send: SCAN /my/file
read reply
send: SCAN /my/file2
read reply
What's pause supposed to
Trog wrote:
You can't send multiple commands. You *must* follow the following sequence:
send: SESSION
pause
send: SCAN /my/file
read reply
send: SCAN /my/file2
read reply
No, not in the same connection, one scan per connection, multiple
connections. ie:
connect 1:
send: STREAM\n
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Steve Platt
Sent: maandag 7 maart 2005 12:00
To: ClamAV users ML
Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
[EMAIL PROTECTED] said:
I can also not say I understand
On Mon, 2005-03-07 at 08:23 -0500, Robert Blayzor wrote:
No, not in the same connection, one scan per connection, multiple
connections. ie:
connect 1:
send: STREAM\n
waitfor: PORT \d+
connect 2: localhost:(port)
dump message
wait for response
close connect 2:
close connect 1:
repeat
Trog wrote:
On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
Trog wrote:
You can't send multiple commands. You *must* follow the following
sequence:
send: SESSION
pause
send: SCAN /my/file
read reply
send: SCAN /my/file2
read reply
What's pause supposed
On Mon, 2005-03-07 at 13:36 +, Mark wrote:
Seemed like a pretty legitimate question to me. The PDF manual
says close to nothing about SESSION/END, and certainly does not
speak of a pause. In fact, if pause is really meant, in the
manner you quote, then this would be a horridly silly
Trog wrote:
In that case it should be:
connect 1:
send: STREAM\n
waitfor: PORT \d+
connect 2: localhost:(port)
dump message
close connect 2:
wait for response
close connect 1:
(notice the close connect 2 moved up)
Ahh you are correct, that's what it does. Regardless, I know it's
On Mon, 2005-03-07 at 08:48 -0500, Robert Blayzor wrote:
Ahh you are correct, that's what it does. Regardless, I know it's
working correctly as it has worked fine for over a year now. Like I
said, recently in 0.83 we've seen it hang up a few times. Both times
I've been able to check the
Trog wrote:
I hope your script handles ERROR responses correctly :-)
I'll give it a whirl, and yes, I seem to have it trapping error
conditions. (unless something changed, this always worked)
eval {
local $SIG{ALRM} = sub { die Stream timeout; };
alarm $sc{TIME_OUT};
while($csock) {
On Mon, 2005-03-07 at 09:38 -0500, Robert Blayzor wrote:
$err = $1 if ($r =~ /^ERROR\:(.*)/);
Assuming I'm reading it right, I think it should be the other way
around. Error strings look like:
Reason ERROR
-trog
signature.asc
Description: This is a digitally signed message part
Le Lun 7 mar 09:38:30 2005, Robert Blayzor écrit:
$err = $1 if ($r =~ /^ERROR\:(.*)/);
die $1\n if $r =~ /(.*) ERROR$/;
You may also remove the starting stream: .
___
http://lurker.clamav.net/list/clamav-users.html
Trog wrote:
Assuming I'm reading it right, I think it should be the other way
around. Error strings look like:
Reason ERROR
Ok, patched that in, thanks for pointing that out. I was basing it on
old clamdscan error string output.
--
Robert Blayzor, BOFH
INOC, LLC
Mark wanted us to know:
Yesterday, I subjected ClamAV to a very rigorous, final
stress test. I let it scan roughly 20,000 news spool files,
and opened an individual connection for each file (not very
efficient, of course, but good to get massive concurrency;
especially since I ran 5 simultaneous
We have some fairly busy mail servers that seem to run clamd fine for
days, and sometimes weeks, but since we moved to ClamAV 0.83 twice now
we've noticed that stream scanning, on rare occasions, starts to hold
connections and timeout.
Here is a clip from our log. clamd itself seems responsive
Robert,
Do your mail logs show what came in just before the problems occurred (twice)?
It might just be that it falls into a class of email messages that cause
clamav ( 0.81 ) to go into hyperspace, examining each bit individually from
every point in five dimensions before giving the message
On Fri, 2005-03-04 at 09:05 -0500, Robert Blayzor wrote:
We have some fairly busy mail servers that seem to run clamd fine for
days, and sometimes weeks, but since we moved to ClamAV 0.83 twice now
we've noticed that stream scanning, on rare occasions, starts to hold
connections and timeout.
Trog wrote:
What software are you using to do stream scanning? It is switched off by
default in clamav-milter 0.83
I'm using a PERL script that is taking the messages and stream scanning
them with clamd. It's been running fine for many months with various
versions of clamd. I've just only
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Steve Platt
Sent: vrijdag 4 maart 2005 16:40
To: ClamAV users ML
Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
I paraphrase; but there was a problem in 0.82 and 0.83 which
25 matches
Mail list logo
