On Tue, May 17, 2005 at 07:01:01PM -0700, Jef Poskanzer said:
> >OK, let me be completely explicit.  You want both
> >Debug
> >Foreground
> >in clamd.conf.  Start a single instance of the milter (by hand - no init
> >script that may daemonize the milter or otherwise hide output from you)=20
> >on an otherwise quiescent machine.  Send an email with the false negative.
> 
> Ok.  With both Debug and Foreground set I am now getting debugging output.
> Yay!  I don't have a quiescent machine, but I was able to catch a
> sample pretty quickly (since I get so many of them).  The false positive
> mail and the full log file are here: http://www.acme.com/jef/tmp/cl/
> The relevant log entries start around line 819, or you can just search
> for the from-address of the sample, "[EMAIL PROTECTED]".
> 
> I don't see anything weird in the debug output, but maybe you will.
Well, the first wierd thing I see off the top of my head is that the
attached zip file never gets scanned.  that would be why it's making it
through the milter, so that part is covered.

Now, of course, the question is why?  For that, i'll really need to see
the entire config file and all the start up options passed to the
milter.

egrep -v '^[[:space:]]*(#|$)' /path/to/clamd.conf, please - that will
cut out all the junk and just leave me with what you're actually using.
-- 
 --------------------------------------------------------------------------
|  Stephen Gran                  | Real programmers can write assembly     |
|  [EMAIL PROTECTED]             | code in any language.   :-)             |
|  http://www.lobefin.net/~steve | -- Larry Wall in  <[EMAIL PROTECTED]         
   |
|                                | devvax.JPL.NASA.GOV>                    |
 --------------------------------------------------------------------------

Attachment: pgpkJ80jd4re4.pgp
Description: PGP signature

_______________________________________________
http://lurker.clamav.net/list/clamav-users.html

Reply via email to