Problem with Sophos SAVI

[Derek Winkler]

Using MailScanner 4.20-3, I know I need to upgrade.

When using Sophos SAVI I get a lot of log entries such as:

Nov 18 11:15:05 lime MailScanner[16383]: Virus Scanning: SophosSAVI found 1
infections

648 of them in a one hour period, whereas Clam only found 4 viruses in the
same time period.

I added a line, logging the commented out debug '#print STDERR "Processing
line \"$_\" produced $Counter\n";', in SweepViruses.pm which logged the
following:

Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line
"/var/spool/MailScanner/incoming/29594/./hAIGmYU29609/msg-29594-6.txt: OK\n"
produced 0
Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line "Namelist
is /opt/MailScanner/etc/reports/en/languages.conf\n" produced 1
Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line "CLEAN::
:: ./hAIGmYU29609/msg-29594-6.txt\n" produced 1
Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line
"/var/spool/MailScanner/incoming/29626/./hAIGnTU29706.header: OK\n" produced
0
Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line
"/var/spool/MailScanner/incoming/29626/./hAIGnTU29706/msg-29626-1.txt: OK\n"
produced 0
Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line "Namelist
is /opt/MailScanner/etc/reports/en/languages.conf\n" produced 1

The log entries with:

Processing line "Namelist is
/opt/MailScanner/etc/reports/en/languages.conf\n" produced 1

looked suspicious to me.

In ProcessSophosSAVIOutput, I added the following lines...

  } elsif ($keyword =~ /^namelist/i) {
    return 0;

seemed to fix it. Sorry I didn't keep the original SweepViruses.pm so I
can't do a diff.

I noticed that Config.pm has the line:

print "Namelist is $namelist\n";

Thanks,

Derek

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20031118/5615770f/attachment.html