Hello Pi-Web,
Yep.
The clue was in the log:
m='20080116183528_10882.msg'
Note that the path was missing - only the file name was present.
Now your logs should look more like:
m='/var/spool/snfilter/msg/20080116183528_10882.msg'
Best,
_M
Wednesday, January 16, 2008, 1:23:14 PM, you wrote:
> Adding $INSPECT_DIR to the "$SNIFFER_EXE $AUTHENTICATION
> $INSPECT_DIR$MSGFILE || {" command
> Now it seems to work.
>>
>> It seems right - but no go:
>>
>> In /var/spool/snfilter/msg/
>> -rw------- 1 snfilter snfilter 2965 Jan 16 18:35 20080116183528_10882.msg
>> (deleted after process finished)
>>
>> Result:
>> <s u='20080116173528' m='20080116183528_10882.msg' code='69'
>> error='ERROR_MSG_FILE'/>
>>
>> sniffer setup:
>>
>> SNIFFER_EXE=/var/spool/snfilter/SNFClient.exe
>> AUTHENTICATION=XXXXXXXX
>> INSPECT_DIR=/var/spool/snfilter/msg/
>> SENDMAIL="/usr/sbin/sendmail -i"
>> MSGFILE=`date +%Y%m%d%H%M%S`_$_$RANDOM.msg
>>
>>
>>
>>
>>> Hello Pi-Web,
>>>
>>> ERROR_MSG_FILE means that SNF could not open the file to be scanned.
>>>
>>> Be sure the you pass the full path of the message file and that
>>> permissions are correct so that SNF can open the file.
>>>
>>> Hope this helps,
>>>
>>> _M
>>>
>>> Wednesday, January 16, 2008, 12:31:58 PM, you wrote:
>>>
>>>> No its not the message format. A message the get ERROR_MSG_FILE work
>>>> fine on our windows SNF
>>>> installation.
>>>
>>>
>>>>> Hi
>>>>>
>>>>> We trying to setup snf with postfix.
>>>>> It seems to work - except it does not reject ant messages.
>>>>>
>>>>> The xxxxx.20080116.log.xml says:
>>>>> <s u='20080116110805' m='20080116120805_22626.msg' code='69'
>>>>> error='ERROR_MSG_FILE'/>
>>>>>
>>>>> This I belive is because the msg file that is send to sniffer has a
>>>>> wrong format.
>>>>> - If true - how do we setup the right format for sniffer?
>>>
>>>
>>>
>>>
>>>
>>
>>
--
Pete McNeil
Chief Scientist,
Arm Research Labs, LLC.
#############################################################
This message is sent to you because you are subscribed to
the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
