ProcessClamAVOutput unrecognised line (with up-to-date clamav)

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----


On 4 Oct 2005, at 15:53, mikea wrote:

> On Tue, Oct 04, 2005 at 02:12:00PM +0200, Nicolas Schmitz wrote:
>
>> Hi,
>> I've got a little trouble here, from time to time I see the following
>> lines in mail.log :
>>
>> MailScanner[17637]: poster.pdf
>> MailScanner[17637]: ProcessClamAVOutput: unrecognised line  
>> "poster.pdf".
>> Please contact the authors!
>>
>> MailScanner (4.41.3-2) is running on Debian sarge , with latest  
>> clamav
>> package from volatile : 0.87-0volatile1.
>>
>> it's really annoying because I use logcheck, and I can't exclude that
>> kind of lines...
>>
>> Am I the only one who have this problem ?
>>
>
> No. I find it merely an annoyance, though, not a problem.
>
> Oct  4 00:35:50 isdmona MailScanner[14105]: Virus and Content  
> Scanning: Starting
> Oct  4 00:35:51 isdmona MailScanner[14105]: /var/spool/MailScanner/ 
> incoming/14105/./j945ZnFh031367/msg-14105-159.txt: Empty file
> Oct  4 00:35:51 isdmona MailScanner[14105]: ProcessClamAVOutput:  
> unrecognised line "/var/spool/MailScanner/incoming/14105/./ 
> j945ZnFh031367/msg-14105-159.txt: Empty file". Please contact the  
> authors!
>
> It appears to happen only when the spammer sends an empty attachment,
> though I haven't looked into it very deeply.

Don't worry, it is quite harmless. If you want to stop it doing this,  
apply this patch:

- --- SweepViruses.pm.old    2005-07-11 16:44:22.000000000 +0100
+++ SweepViruses.pm     2005-10-04 16:52:35.874101033 +0100
@@ -2466,7 +2466,8 @@
    $logline = $line;
    $logline =~ s/%/%%/g;
    MailScanner::Log::WarnLog("ProcessClamAVOutput: unrecognised " .
- -                            "line \"$logline\". Please contact the  
authors!");
+                            "line \"$logline\". Please contact the  
authors!")
+    unless $logline =~ /Empty.*file/;
    return 0;
}

That is for /usr/lib/MailScanner/MailScanner/SweepViruses.pm. Remove  
one line and replace it with 2 new lines. Pretty obvious I hope :-)
- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.2 (Build 2425)

iQEVAwUBQ0Klqfw32o+k+q+hAQEscAf9Gp8BJFuF8iK29iUaWIgsf1Ke7a0Vhdif
XaPpM0E9jTWkK+7g+JFo7CgkxqeevR9/IawQkyXMV2vysC1LFWlvTitqPlKerrcV
/mEzu4hGtYXAU02Zq1DjdT8IdC6vKZK7HlI1Zk9iTliUP9j5U+mWOvva9Ow2isUb
eu1p2xLDQ4EtNitte6zv5XgI53jbbciHPD+GZMQvUuN0hqV/c2bVQGWJ6GOZSjRH
RevATtuwRhgy2ER4dK/iscpJwkMusvYgiGB+C0iJyLYH+B257WNIfLL5V1nk04Fz
0ysOoxLikULlJEFCWU/A4jNsHsRA4DIf7EYR02VMOf0cwT+Bg0jNgw==
=tJ/b
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!