<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
I have mail scanner working on my system (RedHat 7.1) for 1 week and I
think that there are no problems. My log looks like the log you show as
'failed scanning' but I'm sure it's working because in the past week 2
viruses were caught. I never restared mail scanner and I set the memory
leak restart protection to be weekly. I'm using Sophos so when I look at
the log when the virus is caught I see something slightly different that
you show (I don't remember if you're using Sophos). I don't save infected
files. Perhaps you have some strange file permission problem on the 'bad'
server.
<p>Miguel
<p>Scott Farrell wrote:
<blockquote TYPE=CITE>
<br><font face="sans-serif"><font size=-1>Just an update.</font></font>
<p><font face="sans-serif"><font size=-1>Below are succesfull and failed
scanning logs. You'll notice the successgul one takes about 2 seconds,
and the failed one is instant with no logging.</font></font>
<p><font face="sans-serif"><font size=-1>Restarting mailscanner fixes the
problem, but it eventually re-occurs.</font></font>
<p><font face="sans-serif"><font size=-1>Any Ideas?</font></font>
<p><font face="sans-serif"><font size=-1>Here is my log from the failed
scanning :</font></font>
<p><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: Using flock() to lock /var/spool/mqueue.in/qffBFLsMd10664</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: Using flock() to lock >/var/spool/MailScanner/incoming/fBFLsMd10664.header</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: Scanning 1 messages, 1205 bytes</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: Going to scan 1 messages</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: Commencing scanning...</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: Completed scanning</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: Scanned 1 messages, 1205 bytes in 0 seconds</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: Using flock() to lock >/var/spool/mqueue/tffBFLsMd10664</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 08:54:52 icconsulting3
mailscanner[10542]: About to deliver 1 messages</font></font>
<p><font face="sans-serif"><font size=-1>Here is my log from a successful
scanning :</font></font>
<p><font face="sans-serif"><font size=-1>Dec 16 00:43:30 icconsulting3
mailscanner[7897]: Using flock() to lock >/var/spool/MailScanner/incoming/fBFDh5t07901.header</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:30 icconsulting3
mailscanner[7897]: Scanning 1 messages, 1205 bytes</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:31 icconsulting3
mailscanner[7897]: Going to scan 1 messages</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:31 icconsulting3
mailscanner[7897]: Commencing scanning...</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: ----------/data/MailScanner/incoming/./fBFDh5t07901.header</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: ----------/data/MailScanner/incoming/./fBFDh5t07901/msg-7897-1.dat</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: File /data/MailScanner/incoming/./fBFDh5t07901/msg-7897-1.dat
is infected by virus: EICAR test file</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: File /data/MailScanner/incoming/./fBFDh5t07901/msg-7897-1.dat
is infected by virus: EICAR test file</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]:</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Total Files Scanned: 2</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Total Viruses Found: 1</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Total Infected Files Found: 1</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Total Archives Scanned: 1</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Scan Mode: Reviewer</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]:</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: *** End Of Summary ***</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Completed scanning</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Found 1 viruses in messages fBFDh5t07901</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Scanned 1 messages, 1205 bytesin 2 seconds</font></font>
<br><font face="sans-serif"><font size=-1>Dec 16 00:43:33 icconsulting3
mailscanner[7897]: Saved infections to /var/spool/MailScanner/quarantine/20011216/fBFDh5t07901</font></font>
<br>
<p><font face="sans-serif"><font size=-1>regards</font></font>
<br><font face="sans-serif"><font size=-1>Scott Farrell</font></font>
<p><font face="sans-serif"><font size=-1><A HREF="http://www.icconsulting.com.au">http://www.icconsulting.com.au</A></font></font>
<br><font face="sans-serif"><font size=-1>ic Consulting - the people that
make eBusiness happen.</font></font>
<br><font face="sans-serif"><font size=-1>We offer e-business consulting
and perform services. We deliver high impact consulting, and fast turn
around projects for our clients.</font></font>
<br><font face="sans-serif"><font size=-1>Ask us about Web Content Management,
Web Self Service, or working closer with your customers or suppliers.</font></font>
<p><font face="sans-serif"><font size=-1>0412 927 156, 02 9411
3622 <A HREF="mailto:sfarrell@icconsulting.com.au">mailto:sfarrell@icconsulting.com.au</A></font></font>
<br>
<br>
<table WIDTH="100%" >
<tr VALIGN=TOP>
<td></td>
<td><b><font face="sans-serif"><font size=-2>Scott Farrell <sfarrell@ICCONSULTING.COM.AU></font></font></b>
<br><font face="sans-serif"><font size=-2>Sent by: MailScanner mailing
list <MAILSCANNER@JISCMAIL.AC.UK></font></font>
<p><font face="sans-serif"><font size=-2>16/12/2001 12:31 AM</font></font>
<br><font face="sans-serif"><font size=-2>Please respond to MailScanner
mailing list</font></font></td>
<td>
<br><font face="sans-serif"><font size=-2>
To: MAILSCANNER@JISCMAIL.AC.UK</font></font>
<br><font face="sans-serif"><font size=-2>
cc: </font></font>
<br><font face="sans-serif"><font size=-2>
Subject: Re: debug of virus scanner
conversation</font></font></td>
</tr>
</table>
<p><font face="sans-serif"><font size=-1>Thanks Jules ..... I used this
instead, but thanks for your help, it worked wonders ... now I have to
wait until it fails again !!!!!:</font></font>
<p><font face="sans-serif"><font size=-1>Log::InfoLog("$_");</font></font>
<p><font face="sans-serif"><font size=-1>regards</font></font>
<br><font face="sans-serif"><font size=-1>Scott Farrell</font></font>
<p><font face="sans-serif"><font size=-1><A HREF="http://www.icconsulting.com.au">http://www.icconsulting.com.au</A></font></font>
<br><font face="sans-serif"><font size=-1>ic Consulting - the people that
make eBusiness happen.</font></font>
<br><font face="sans-serif"><font size=-1>We offer e-business consulting
and perform services. We deliver high impact consulting, and fast turn
around projects for our clients.</font></font>
<br><font face="sans-serif"><font size=-1>Ask us about Web Content Management,
Web Self Service, or working closer with your customers or suppliers.</font></font>
<p><font face="sans-serif"><font size=-1>0412 927 156, 02 9411
3622 <A HREF="mailto:sfarrell@icconsulting.com.au">mailto:sfarrell@icconsulting.com.au</A></font></font>
<br>
<table WIDTH="100%" >
<tr VALIGN=TOP>
<td WIDTH="2%"></td>
<td WIDTH="53%"><b><font face="sans-serif"><font size=-2>Julian Field <jkf@ECS.SOTON.AC.UK></font></font></b>
<br><font face="sans-serif"><font size=-2>Sent by: MailScanner mailing
list <MAILSCANNER@JISCMAIL.AC.UK></font></font>
<p><font face="sans-serif"><font size=-2>14/12/2001 07:10 PM</font></font>
<br><font face="sans-serif"><font size=-2>Please respond to MailScanner
mailing list</font></font></td>
<td WIDTH="44%">
<br><font face="sans-serif"><font size=-2>
To: MAILSCANNER@JISCMAIL.AC.UK</font></font>
<br><font face="sans-serif"><font size=-2>
cc: </font></font>
<br><font face="sans-serif"><font size=-2>
Subject: Re: debug of virus scanner
conversation</font></font></td>
</tr>
</table>
<p><font face="Courier New"><font size=-1>At 03:19 14/12/2001, you wrote:</font></font>
<br><font face="Courier New"><font size=-1>>I suspect there is some OS
error, or error with InoculateIT, or error</font></font>
<br><font face="Courier New"><font size=-1>>somewhere. I would dearly like
to output the conversion between mailscanner</font></font>
<br><font face="Courier New"><font size=-1>>and the commercial virus program.
Is this possible?</font></font>
<p><font face="Courier New"><font size=-1>Take a look in sweep.pl, at the
TryCommercial function. There's a loop in</font></font>
<br><font face="Courier New"><font size=-1>there that starts "while(<KID>)
{" for each supported virus scanner. If you</font></font>
<br><font face="Courier New"><font size=-1>find the one you are using for
InoculateIT and do a "print STDERR "$_"</font></font>
<br><font face="Courier New"><font size=-1>just inside the top of the loop,
it will dump to STDERR all the output from</font></font>
<br><font face="Courier New"><font size=-1>the virus scanner.</font></font>
<p><font face="Courier New"><font size=-1>Hope that helps!</font></font>
<br><font face="Courier New"><font size=-1>--</font></font>
<br><font face="Courier New"><font size=-1>Julian Field
Teaching Systems Manager</font></font>
<br><font face="Courier New"><font size=-1>jkf@ecs.soton.ac.uk
Dept. of Electronics & Computer Science</font></font>
<br><font face="Courier New"><font size=-1>Tel. 023 8059 2817
University of Southampton</font></font>
<br><font face="Courier New"><font size=-1>
Southampton SO17 1BJ</font></font>
<br>
<br>
<br> </blockquote>
</html>