<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2657.73">
<TITLE>Problem with Sophos SAVI</TITLE>
</HEAD>
<BODY>
<BR>
<P><FONT SIZE=2>Using MailScanner 4.20-3, I know I need to upgrade.</FONT>
</P>
<P><FONT SIZE=2>When using Sophos SAVI I get a lot of log entries such as:</FONT>
</P>
<P><FONT SIZE=2>Nov 18 11:15:05 lime MailScanner[16383]: Virus Scanning: SophosSAVI found 1 infections</FONT>
</P>
<P><FONT SIZE=2>648 of them in a one hour period, whereas Clam only found 4 viruses in the same time period.</FONT>
</P>
<P><FONT SIZE=2>I added a line, logging the commented out debug '#print STDERR "Processing line \"$_\" produced $Counter\n";', in SweepViruses.pm which logged the following:</FONT></P>
<P><FONT SIZE=2>Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line "/var/spool/MailScanner/incoming/29594/./hAIGmYU29609/msg-29594-6.txt: OK\n" produced 0</FONT></P>
<P><FONT SIZE=2>Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line "Namelist is /opt/MailScanner/etc/reports/en/languages.conf\n" produced 1</FONT></P>
<P><FONT SIZE=2>Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line "CLEAN:: :: ./hAIGmYU29609/msg-29594-6.txt\n" produced 1</FONT></P>
<P><FONT SIZE=2>Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line "/var/spool/MailScanner/incoming/29626/./hAIGnTU29706.header: OK\n" produced 0</FONT></P>
<P><FONT SIZE=2>Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line "/var/spool/MailScanner/incoming/29626/./hAIGnTU29706/msg-29626-1.txt: OK\n" produced 0</FONT></P>
<P><FONT SIZE=2>Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line "Namelist is /opt/MailScanner/etc/reports/en/languages.conf\n" produced 1</FONT></P>
<P><FONT SIZE=2>The log entries with:</FONT>
</P>
<P><FONT SIZE=2>Processing line "Namelist is /opt/MailScanner/etc/reports/en/languages.conf\n" produced 1 </FONT>
</P>
<P><FONT SIZE=2>looked suspicious to me.</FONT>
</P>
<P><FONT SIZE=2>In ProcessSophosSAVIOutput, I added the following lines...</FONT>
</P>
<P><FONT SIZE=2> } elsif ($keyword =~ /^namelist/i) {</FONT>
<BR><FONT SIZE=2> return 0;</FONT>
</P>
<P><FONT SIZE=2>seemed to fix it. Sorry I didn't keep the original SweepViruses.pm so I can't do a diff.</FONT>
</P>
<P><FONT SIZE=2>I noticed that Config.pm has the line:</FONT>
</P>
<P><FONT SIZE=2>print "Namelist is $namelist\n";</FONT>
</P>
<P><FONT SIZE=2>Thanks,</FONT>
</P>
<P><FONT SIZE=2>Derek</FONT>
</P>
</BODY>
</HTML>