<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2657.73">
<TITLE>RE: Problem with Sophos SAVI</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>As per below found...</FONT>
</P>
<P><FONT SIZE=2>>I noticed that Config.pm has the line:</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>print "Namelist is $namelist\n";</FONT>
<BR><FONT SIZE=2>></FONT>
</P>
<P><FONT SIZE=2>Guess I could have just commented that out.</FONT>
</P>
<P><FONT SIZE=2>Sorry about the HTML posts for some reason the Exchange server here converts to HTML, only does it when I post to this list. When I post to the MRTG list it doesn't do it.</FONT></P>
<P><FONT SIZE=2>Thanks,</FONT>
</P>
<P><FONT SIZE=2>Derek</FONT>
</P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: MailScanner mailing list [<A HREF="mailto:MAILSCANNER@JISCMAIL.AC.UK">mailto:MAILSCANNER@JISCMAIL.AC.UK</A>]On</FONT>
<BR><FONT SIZE=2>Behalf Of Julian Field</FONT>
<BR><FONT SIZE=2>Sent: Tuesday, November 18, 2003 12:37 PM</FONT>
<BR><FONT SIZE=2>To: MAILSCANNER@JISCMAIL.AC.UK</FONT>
<BR><FONT SIZE=2>Subject: Re: Problem with Sophos SAVI</FONT>
</P>
<BR>
<P><FONT SIZE=2>Can you do</FONT>
</P>
<P><FONT SIZE=2>cd /usr/lib/MailScanner/MailScanner</FONT>
<BR><FONT SIZE=2>grep Namelist *</FONT>
</P>
<P><FONT SIZE=2>please?</FONT>
</P>
<P><FONT SIZE=2>At 17:16 18/11/2003, you wrote:</FONT>
</P>
<P><FONT SIZE=2>>Using MailScanner 4.20-3, I know I need to upgrade.</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>When using Sophos SAVI I get a lot of log entries such as:</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Nov 18 11:15:05 lime MailScanner[16383]: Virus Scanning: SophosSAVI found</FONT>
<BR><FONT SIZE=2>>1 infections</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>648 of them in a one hour period, whereas Clam only found 4 viruses in the</FONT>
<BR><FONT SIZE=2>>same time period.</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>I added a line, logging the commented out debug '#print STDERR "Processing</FONT>
<BR><FONT SIZE=2>>line \"$_\" produced $Counter\n";', in SweepViruses.pm which logged the</FONT>
<BR><FONT SIZE=2>>following:</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line</FONT>
<BR><FONT SIZE=2>>"/var/spool/MailScanner/incoming/29594/./hAIGmYU29609/msg-29594-6.txt:</FONT>
<BR><FONT SIZE=2>>OK\n" produced 0</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line</FONT>
<BR><FONT SIZE=2>>"Namelist is /opt/MailScanner/etc/reports/en/languages.conf\n" produced 1</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Nov 18 11:49:45 lime MailScanner[29594]: dwdebug: Processing line "CLEAN::</FONT>
<BR><FONT SIZE=2>>:: ./hAIGmYU29609/msg-29594-6.txt\n" produced 1</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line</FONT>
<BR><FONT SIZE=2>>"/var/spool/MailScanner/incoming/29626/./hAIGnTU29706.header: OK\n" produced 0</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line</FONT>
<BR><FONT SIZE=2>>"/var/spool/MailScanner/incoming/29626/./hAIGnTU29706/msg-29626-1.txt:</FONT>
<BR><FONT SIZE=2>>OK\n" produced 0</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Nov 18 11:49:50 lime MailScanner[29626]: dwdebug: Processing line</FONT>
<BR><FONT SIZE=2>>"Namelist is /opt/MailScanner/etc/reports/en/languages.conf\n" produced 1</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>The log entries with:</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Processing line "Namelist is</FONT>
<BR><FONT SIZE=2>>/opt/MailScanner/etc/reports/en/languages.conf\n" produced 1</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>looked suspicious to me.</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>In ProcessSophosSAVIOutput, I added the following lines...</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> } elsif ($keyword =~ /^namelist/i) {</FONT>
<BR><FONT SIZE=2>> return 0;</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>seemed to fix it. Sorry I didn't keep the original SweepViruses.pm so I</FONT>
<BR><FONT SIZE=2>>can't do a diff.</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>I noticed that Config.pm has the line:</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>print "Namelist is $namelist\n";</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Thanks,</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Derek</FONT>
</P>
<P><FONT SIZE=2>--</FONT>
<BR><FONT SIZE=2>Julian Field</FONT>
<BR><FONT SIZE=2>www.MailScanner.info</FONT>
<BR><FONT SIZE=2>Professional Support Services at www.MailScanner.biz</FONT>
<BR><FONT SIZE=2>MailScanner thanks transtec Computers for their support</FONT>
<BR><FONT SIZE=2>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654</FONT>
</P>
</BODY>
</HTML>