Building an MS-SA box

[Peter Bonivart]

Michael Weiner wrote:
> That all works fine, and i see the mailscanner stamps in the maillog
> saying that virus and content scanning: Starting but yet no virii found
> even when i send some.

The log line about "virus and content scanning: Starting" doesn't
necessarily mean that virus scanning (as in Clam) is starting, it's used
in a broader context, looking for IFrame, HTML forms and all kinds of
nasty stuff so you get this line even if you don't use a virus scanner.

Could you mail the relevant lines from your MailScanner.conf regarding
the virus scanning?

You could also look in /tmp for lock files from Clam when used by MS, it
should be visible in "top" also. Run two terminals, one "tail -f
maillog" and one with "top", then mail yourself from the outside and
watch closely.

If you send eicar.com it should trigger Clam, file type and file name.

--
/Peter Bonivart

--Unix lovers do it in the Sun

Sun Fire V210, Solaris 9, Sendmail 8.12.10, MailScanner 4.25-14,
SpamAssassin 2.63 + DCC 1.2.30, ClamAV 0.67 + GMP 4.1.2