<br><font size=2 face="sans-serif">Just an update.</font>
<br>
<br><font size=2 face="sans-serif">Below are succesfull and failed scanning logs. You'll notice the successgul one takes about 2 seconds, and the failed one is instant with no logging.</font>
<br><font size=2 face="sans-serif"><br>
Restarting mailscanner fixes the problem, but it eventually re-occurs.</font>
<br><font size=2 face="sans-serif"> </font>
<br><font size=2 face="sans-serif">Any Ideas?</font>
<br>
<br><font size=2 face="sans-serif">Here is my log from the failed scanning :</font>
<br>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: Using flock() to lock /var/spool/mqueue.in/qffBFLsMd10664</font>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: Using flock() to lock >/var/spool/MailScanner/incoming/fBFLsMd10664.header</font>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: Scanning 1 messages, 1205 bytes</font>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: Going to scan 1 messages</font>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: Commencing scanning...</font>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: Completed scanning</font>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: Scanned 1 messages, 1205 bytes in 0 seconds</font>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: Using flock() to lock >/var/spool/mqueue/tffBFLsMd10664</font>
<br><font size=2 face="sans-serif">Dec 16 08:54:52 icconsulting3 mailscanner[10542]: About to deliver 1 messages</font>
<br>
<br><font size=2 face="sans-serif">Here is my log from a successful scanning :</font>
<br>
<br><font size=2 face="sans-serif">Dec 16 00:43:30 icconsulting3 mailscanner[7897]: Using flock() to lock >/var/spool/MailScanner/incoming/fBFDh5t07901.header</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:30 icconsulting3 mailscanner[7897]: Scanning 1 messages, 1205 bytes</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:31 icconsulting3 mailscanner[7897]: Going to scan 1 messages</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:31 icconsulting3 mailscanner[7897]: Commencing scanning...</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: ----------/data/MailScanner/incoming/./fBFDh5t07901.header</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: ----------/data/MailScanner/incoming/./fBFDh5t07901/msg-7897-1.dat</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: File /data/MailScanner/incoming/./fBFDh5t07901/msg-7897-1.dat is infected by virus: EICAR test file</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: File /data/MailScanner/incoming/./fBFDh5t07901/msg-7897-1.dat is infected by virus: EICAR test file</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]:</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Total Files Scanned: 2</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Total Viruses Found: 1</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Total Infected Files Found: 1</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Total Archives Scanned: 1</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Scan Mode: Reviewer</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]:</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: *** End Of Summary ***</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Completed scanning</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Found 1 viruses in messages fBFDh5t07901</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Scanned 1 messages, 1205 bytesin 2 seconds</font>
<br><font size=2 face="sans-serif">Dec 16 00:43:33 icconsulting3 mailscanner[7897]: Saved infections to /var/spool/MailScanner/quarantine/20011216/fBFDh5t07901</font>
<br>
<br><font size=2 face="sans-serif"><br>
regards<br>
Scott Farrell <br>
<br>
http://www.icconsulting.com.au<br>
ic Consulting - the people that make eBusiness happen.<br>
We offer e-business consulting and perform services. We deliver high impact consulting, and fast turn around projects for our clients.<br>
Ask us about Web Content Management, Web Self Service, or working closer with your customers or suppliers.<br>
<br>
0412 927 156, 02 9411 3622 mailto:sfarrell@icconsulting.com.au</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>Scott Farrell <sfarrell@ICCONSULTING.COM.AU></b></font>
<br><font size=1 face="sans-serif">Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK></font>
<p><font size=1 face="sans-serif">16/12/2001 12:31 AM</font>
<br><font size=1 face="sans-serif">Please respond to MailScanner mailing list</font>
<br>
<td><font size=1 face="Arial"> </font>
<br><font size=1 face="sans-serif"> To: MAILSCANNER@JISCMAIL.AC.UK</font>
<br><font size=1 face="sans-serif"> cc: </font>
<br><font size=1 face="sans-serif"> Subject: Re: debug of virus scanner conversation</font></table>
<br><font size=2 face="sans-serif"><br>
Thanks Jules ..... I used this instead, but thanks for your help, it worked wonders ... now I have to wait until it fails again !!!!!:</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="sans-serif"><br>
Log::InfoLog("$_");</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="sans-serif"><br>
regards<br>
Scott Farrell <br>
<br>
http://www.icconsulting.com.au<br>
ic Consulting - the people that make eBusiness happen.<br>
We offer e-business consulting and perform services. We deliver high impact consulting, and fast turn around projects for our clients.<br>
Ask us about Web Content Management, Web Self Service, or working closer with your customers or suppliers.<br>
<br>
0412 927 156, 02 9411 3622 mailto:sfarrell@icconsulting.com.au</font><font size=3 face="Times New Roman"> <br>
<br>
</font>
<table width=100%>
<tr valign=top>
<td width=2%>
<td width=53%><font size=1 face="sans-serif"><b>Julian Field <jkf@ECS.SOTON.AC.UK></b></font><font size=3 face="Times New Roman"> </font><font size=1 face="sans-serif"><br>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK></font><font size=3 face="Times New Roman"> </font>
<p><font size=1 face="sans-serif">14/12/2001 07:10 PM</font><font size=3 face="Times New Roman"> </font><font size=1 face="sans-serif"><br>
Please respond to MailScanner mailing list</font><font size=3 face="Times New Roman"> </font>
<td width=44%><font size=1 face="Arial"> </font><font size=1 face="sans-serif"><br>
To: MAILSCANNER@JISCMAIL.AC.UK</font><font size=3 face="Times New Roman"> </font><font size=1 face="sans-serif"><br>
cc: </font><font size=3 face="Times New Roman"> </font><font size=1 face="sans-serif"><br>
Subject: Re: debug of virus scanner conversation</font></table>
<br><font size=2 face="Courier New"><br>
At 03:19 14/12/2001, you wrote:<br>
>I suspect there is some OS error, or error with InoculateIT, or error<br>
>somewhere. I would dearly like to output the conversion between mailscanner<br>
>and the commercial virus program. Is this possible?<br>
<br>
Take a look in sweep.pl, at the TryCommercial function. There's a loop in<br>
there that starts "while(<KID>) {" for each supported virus scanner. If you<br>
find the one you are using for InoculateIT and do a "print STDERR "$_"<br>
just inside the top of the loop, it will dump to STDERR all the output from<br>
the virus scanner.<br>
<br>
Hope that helps!<br>
--<br>
Julian Field Teaching Systems Manager<br>
jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science<br>
Tel. 023 8059 2817 University of Southampton<br>
Southampton SO17 1BJ</font><font size=3 face="Times New Roman"><br>
<br>
</font>
<br>
<br>