>I am also trying to figure out why it would hit a Noprocessing rule it seems like 'npRe' has matched
>noScanIP I can't reproduce this issue - it works for me. first, check that your noScanIP is working - open an IP-address info dialog and chech the IP the output should be similar to: ------------------------- add/remove IP addresses from lists IP-address or hostname to work with Only configured, possible and authorized option are shown. results for action (page was auto reloaded) general IP-matches for 10.10.10.250 : matches in noScanIP with 10.10.10.250/32 ------------------------- tell me if this works. Thomas Von: Doug Lytle <supp...@drdos.info> An: ASSP Test <assp-test@lists.sourceforge.net> Datum: 17.01.2015 15:18 Betreff: [Assp-test] ClamAV - ASSP version 2.4.4(15004) I'm running ASSP on Debian 7.7 (wheezy) on the current ASSP release. I've specified that IP address 10.10.10.250 should not be scanned because some times the SaneSecurity signatures are triggered on my daily reports. Today, I just noted that I haven't seen a report in a couple days and reviewed the ASSP logs. They show that ClamAV is still scanning the excluded IP address. 09-01-2015 23:30:09 m1-64209-07507 [Worker_1] [TLS-out] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info Regex:Noprocessing '@lists.digium.com' 09-01-2015 23:30:09 m1-64209-07507 [Worker_1] [TLS-out] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info ClamAV: scanned 12159 bytes in local message - FOUND Sanesecurity.Jurlbl.5698.UNOFFICIAL(dd164f7548721d3945ba20d3bd690427:12159) 09-01-2015 23:30:09 m1-64209-07507 [Worker_1] [TLS-out] [VIRUS] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info [spam found] (virus detected: 'Sanesecurity.Jurlbl.5698.UNOFFICIAL(dd164f7548721d3945ba20d3bd690427:12159)') [Daily mail report for 2015 01 09] -> /assp/quarantine/--159007.eml; 09-01-2015 23:30:09 m1-64209-07507 [Worker_1] [TLS-out] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info [SMTP Error] 554 5.7.1 Mail appears infected with \[Sanesecurity.Jurlbl.5698.UNOFFICIAL(dd164f7548721d3945ba20d3bd690427:12159)\]. ASSP config: Do Not Scan Messages from these IP's* (noScanIP) 10.10.10.250|192.168.145.10 I am also trying to figure out why it would hit a Noprocessing rule for lists.digium.com? In fact, I see different entries matching different Noprocessing rules: 16-01-2015 23:30:09 m1-69009-08961 [Worker_2] [TLS-out] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info Regex:Noprocessing '@mythtv.org' 16-01-2015 23:30:09 m1-69009-08961 [Worker_2] [TLS-out] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info ClamAV: scanned 12013 bytes in local message - FOUND Sanesecurity.Jurlbl.6418.UNOFFICIAL(737417455cdbdc73f8034fdabb8fb028:12013) 16-01-2015 23:30:09 m1-69009-08961 [Worker_2] [TLS-out] [VIRUS] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info [spam found] (virus detected: 'Sanesecurity.Jurlbl.6418.UNOFFICIAL(737417455cdbdc73f8034fdabb8fb028:12013)') [Daily mail report for 2015 01 16] -> /assp/quarantine/--160579.eml; 16-01-2015 23:30:09 m1-69009-08961 [Worker_2] [TLS-out] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info [SMTP Error] 554 5.7.1 Mail appears infected with \[Sanesecurity.Jurlbl.6418.UNOFFICIAL(737417455cdbdc73f8034fdabb8fb028:12013)\]. Is there something I missing? Thanks, Doug Doug -- Ben Franklin quote: "Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety." ------------------------------------------------------------------------------ New Year. New Location. New Benefits. New Data Center in Ashburn, VA. GigeNET is offering a free month of service with a new server in Ashburn. Choose from 2 high performing configs, both with 100TB of bandwidth. Higher redundancy.Lower latency.Increased capacity.Completely compliant. http://p.sf.net/sfu/gigenet _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* ------------------------------------------------------------------------------ New Year. New Location. New Benefits. New Data Center in Ashburn, VA. GigeNET is offering a free month of service with a new server in Ashburn. Choose from 2 high performing configs, both with 100TB of bandwidth. Higher redundancy.Lower latency.Increased capacity.Completely compliant. http://p.sf.net/sfu/gigenet _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
