Messages being disarmed

[Mark Sapiro]

On 12/21/2016 04:37 AM, Jason Waters wrote:
> I would tend to agree...I just can't find where!  I have everything set
> as postfix.  All the permissions seem to still be postfix.  Do I need to
> run clamd or spamassassin as postfix?


You said you have in /etc/group
postfix:x:117:clamav,www-data,mail

I.e. clamav is in the postfix group. If you have

User clamav

in /etc/clamav/clamd.conf and

Incoming Work Permissions = 0660

in MailScanner.conf, that "should" be OK. As Shawn suggests, are you
running any security manager like SELinux or apparmor?


> Can I turn the logging up so I can
> see what is actually happening?


Unfortunately no. You have to go through the code in
/usr/share/MailScanner/perl/MailScanner/Message.pm and manually add
logging statements.

There might possibly be something in some other system log. Given
something like

Dec 19 10:31:05 mailscanner MailScanner[2718]: HTML disarming died,
status = 13

you could

sudo zgrep -r 'Dec 19 10:31:0' /var/log

(I intentionally dropped the 5 from 05) to see if anything interesting
is logged in that time frame.

Note that the PID that died is not 2718 in this case. The process forks
and 2718 is the parent while the process that died is the child.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan