It would be better if these were consistent.
Also, it seems to me that a regex is overkill, while a literal string is
rather limiting. Might it not be better simply to use the standard file
path pattern with wildcard characters ('*'), like (e.g.) rsync uses?
On Thu, 26 Sep 2019 11:30:01 +0200
Franky Van Liedekerke via clamav-users <clamav-users@lists.clamav.net>
wrote:
> Op Donderdag, 26-09-2019 om 11:22 schreef G.W. Haywood via
> clamav-users:
> > Hi there,
> >
> > On Thu, 26 Sep 2019, CROFT Ian wrote:
> >
> > > But when I put an EICAR test txt file in /var/log/test.txt it is
> > > getting picked up by the OnAccess scanner.
> > >
> > > I have tried ^/var/log/ and ^/var/log/* - same issue the test.txt
> > > is still picked up by the OnAccess scanner when it should in my
> > > mind be being ignored.
> > >
> > > Any ideas ?
> >
> > You really do need to get used to reading the 'man' pages.
> >
> > In this case the man page for clamd.conf states
> >
> > OnAccessExcludePath STRING
> >
> > which means that the argument is a STRING, not a REGEX.
> >
> > You must not put things like '^' and '*' in a STRING argument
> > because a STRING is taken literally. You are excluding names
> > which do not exist on your system.
>
> While Ian just followed my example (which was wrong apparently), it
> is kind of confusing in clamd.conf:
>
> ExcludePath REGEX
> OnAccessExcludePath STRING
>
> Easy enough to miss ...
>
> Franky
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
