Thanks, Rene,
I recompiled normally... not in debug mode and seems to be working fine. I
have a couple more question though... See below...
06:35:14.68 2 SMTPI-00007(cgr4u.com) [30014] received, 978 bytes
06:35:14.69 2 QUEUE([30014]) from <[EMAIL PROTECTED]>, 978 bytes
(<[EMAIL PROTECTED]>)
06:35:14.69 1 ENQUEUERRULES [30014] rule(ClamAV) action #1: filter report:
\nWARNING! Your message was infected by VIRUS:\nEicar-Test-Signature\n\nIt
was rejected for delivery.\n\nAntiviral program output:
\n==================================================\n\t\tinfected:
Eicar-Test-Signature\n=====
06:35:14.69 1 ENQUEUER-01([30014]) Server rules failed: Error Code=external
filter rejected the message
06:35:14.69 1 DEQUEUER [30014] SYSTEM(jkeen) failed
06:35:14.69 2 DEQUEUER-01 [30014] generating report message
06:35:14.69 2 QUEUE([30011]) from <>, 1929 bytes
(<[EMAIL PROTECTED]>)
06:35:14.69 2 DEQUEUER-01 report [30011] is composed for [30014]
06:35:14.69 2 QUEUE([30014]) deleted
06:35:14.71 2 ENQUEUER-01([30011]) enqueued
06:35:16.37 2 SMTP-00007(ventuer.com) [30011] sent to [66.132.152.66:25],
got:250 ok 1108035714 qp 23457
06:35:16.37 2 DEQUEUER [30011] SMTP(ventuer.com)[EMAIL PROTECTED] relayed
06:35:16.37 2 QUEUE([30011]) deleted
06:35:26.00 2 PIPE [30015] received in {Submitted/11vir.sub}, 715 bytes
06:35:26.00 2 QUEUE([30015]) from <[EMAIL PROTECTED]>, 715 bytes
(<[EMAIL PROTECTED]>)
06:35:26.00 2 ENQUEUER-01([30015]) enqueued
06:35:26.60 2 SMTP-00008(ventuer.com) [30015] sent to [66.132.152.66:25],
got:250 ok 1108035724 qp 23463
06:35:26.60 2 DEQUEUER [30015] SMTP(ventuer.com)[EMAIL PROTECTED] relayed
06:35:26.60 2 QUEUE([30015]) deleted
1) should I be getting the Action#1 Filter report. That seems like a lot of
output.
2) Enqueuer -- Server Rules failed.. Filter Rejected message.. What does that
mean?
3) Finally, I am recieving both a rejection message from my SMTP server and a
rejection message from CGPAV. How can I eliminate one of them?
Note is appears to be working though. I even get the following entry in
the /var/log/mail...
Feb 8 06:35:14 DoodyEmail clamd[4094]: /var/CommuniGate/Queue/30014.msg:
Eicar-Test-Signature FOUND
Thanks to both of you..
Jerry
On Monday 07 February 2005 22:25, René Berber wrote:
> Jerry Keen wrote:
> > Hi Rene,
>
> Hello.
>
> > Thank you for your quick response...
> >
> > I am running on Suse Linux 9.1. CGPAV 1.3c.
>
> It should work fine.
>
> > I test it manually and it works every time.
> >
> > As for the helper configuration. If I leave restart and timeout on
> > disabled. The external helper output error continues indefinitely. The
> > problem is now that I have to restart the helper every xx seconds. I
> > don't think this is very efficient. Right now I have it for 15 seconds.
>
> The recomendation of using no timeout is because cgpav uses several
> threads to communicate with clamd, one for each message being scanned
> concurrently. It's difficult to set a timeout value since it will
> depend on the speed of the machine, the CPU load, the email messages
> load...
>
> But since cgpav should be working let's find out why it is not.
>
> > As for the verbose...ness....
> > I did compile in debug mode and set the helper to log all info for
> > troubleshooting purposes.
>
> Debug mode is fine for manual tests but, as you are seeing, CG doesn't
> like it (at one time I changed all the debug printf adding "* " at the
> beginning, that way CG accepts those messages as information).
>
> The debug messages made the log in your post almost useless, and in fact
> they don't show why cpgpav stops running (or closes it's output) which
> is making CG restart it.
>
> Try a run without debug messages. The interesting part, and it looks
> fine in your log, is that cgpav starts communicating with CG, it also
> communicates fine with clamd, then I think CG just received to much
> output (it has a small read buffer) and just quit reading. Right now
> the only thing I saw in the log was that debug output causes problems.
>
> So, lets try without debug mode and see if the log shows something
> interesting.
--
Jerry Keen
phone : 954-336-6241
fax : 954-252-3945
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
