On Wed, 17 Mar 2004 15:35:28 +0100
Wolfgang Cernohorsky <[EMAIL PROTECTED]> wrote:
> After updating to v0.70-rc I've noticed, that the owner of the
> database directories (/usr/local/share/clamav on my linux box) changes
> to clamav but clamav runs on my box under user amavisd, so do
> freshclam -
On Wed, 17 Mar 2004 22:49:37 -0500
Robert Blayzor <[EMAIL PROTECTED]> wrote:
> I am running devel snapshot 20040415 on FreeBSD 4.9.
>
> I'm having a problem with clamd, the process randomly hanging on
> either reloading the database and sometimes scanning mbox files. It's
> very strange. When t
On Fri, 19 Mar 2004 21:43:03 +0100
Andrej Trobentar <[EMAIL PROTECTED]> wrote:
> Hello all,
>
> I'm trying to set up clamd with multilog. I have followed the post
> located on
> http://www.mail-archive.com/[EMAIL PROTECTED]/msg06804.html,
>
> but if I set LogFile to /dev/stdout and do a "svc -
On Fri, 19 Mar 2004, Robert Schmidt wrote:
> When I say bounce I mean reject.
That's better, but still makes the problem worse. At the very least, you
should filter out rejections from worms.
> It is bad practice to drop messages in the round file and not tell
> anyone about it.
Not if the mess
Steven Stern wrote:
On Fri, 19 Mar 2004 17:55:03 -0600, Steven Stern
<[EMAIL PROTECTED]> wrote:
It works appropriately if the mail comes from an external server. I'm leaving
-b in place and will see how it goes for a while.
--
Steve
Yea thats how we do it here, I wasn't thinking mail bei
On Fri, 19 Mar 2004 17:55:03 -0600, Steven Stern
<[EMAIL PROTECTED]> wrote:
>
It works appropriately if the mail comes from an external server. I'm leaving
-b in place and will see how it goes for a while.
--
Steve
---
This SF.Net email
On Fri, 19 Mar 2004 17:51:11 -0500, Ryan Moore <[EMAIL PROTECTED]> wrote:
>
>You probably want the -b option to reject the DATA phase of the SMTP
>session if the milter detects a virus.
>
I added the -b option to clamav-milter.
As root, i typed " cat eircar.com | mail steve -s test "
Sendmail
On Fri, 19 Mar 2004 16:20:38 -0600 (CST), Damian Menscher <[EMAIL PROTECTED]>
wrote:
>
>I'll readily agree that creating new notification messages is just
>stupid. Rejecting the message (with a 550 status, for example) is the
>best thing to do. This leaves it up to the machine sending the virus
On Fri, 2004-03-19 at 12:04, Sergey wrote:
> Fri Mar 19 10:15:31 2004 -> ERROR: accept() failed: Too many open files
> Fri Mar 19 10:15:32 2004 -> ERROR: accept() failed: Too many open files
> Fri Mar 19 10:15:33 2004 -> ERROR: accept() failed: Too many open files
How do your numbers compare to t
On Fri, 19 Mar 2004 18:25:25 -0500 (EST), Pat Masterson <[EMAIL PROTECTED]>
wrote:
>Stve, I had the same problem, and do this in my start script:
>rm /var/run/clamav/clmilter.sock
>chmod 777 /var/run/clamav/
>=> start milter here <=
>chmod 755 /var/run/clamav/
>=> start sendmail here <=
>
>And nob
On Fri, 19 Mar 2004 13:27:46 -0800
Doug Hardie <[EMAIL PROTECTED]> wrote:
> Well, I went back and rebuilt clamd with --disable-urandom and thats
> exactly what it does. It comments out the define of C_URANDOM. I
> don't quite see how it does that yet, but thats not important. It
> make clamd
On Fri, 19 Mar 2004 22:48:05 +0100 (CET)
Krzysztof Snopek <[EMAIL PROTECTED]> wrote:
> On Fri, 19 Mar 2004, Nigel Horne wrote:
>
> >
> > > Mar 19 13:37:36 topaz clamav-milter[17382]: [ID 910239 mail.error]
> > > write failure to clamd
> >
> > That reads to me that clamd has gone away
>
> No, it'
Hello all,
Its been a while, but I just uploaded a completely new build of clamav for
Windows. Its based off of today's CVS.
http://www.sosdg.org/clamav-win32
I still haven't gotten the DLL version to build or work properly (ie:
cygclamav-90.dll thing, or whatever its called).
This version als
Steven Stern wrote:
I am an idiot.
The sock file was defined with one name in sendmail.mc and another in the
configuration file for the milter itself. I made them the same and sendmail is
happy.
so what's supposed to happen when it detects a virus? When I send myself a
message with eicar.com attac
> On Fri, 2004-03-19 at 12:51, Jim Maul wrote:
>> > We tend to forward the postmaster account off our each of our mail
>> > servers to other central servers that the admins read it on. If the
>> > postmaster account receives a virus (they are fairly popular addresses
>> > for spam and virus email)
On Fri, 19 Mar 2004, Antony Stone wrote:
> On Friday 19 March 2004 9:21 pm, Robert Schmidt wrote:
>
> > We bounce messages that have viruses.
>
> That sounds like a terrible idea.
Depends on what he meant by "bounce". These days, I find it useful to
distinguish between "reject" and "send notifica
I am an idiot.
The sock file was defined with one name in sendmail.mc and another in the
configuration file for the milter itself. I made them the same and sendmail is
happy.
so what's supposed to happen when it detects a virus? When I send myself a
message with eicar.com attached, this header
On Fri, 2004-03-19 at 17:01, jef moskot wrote:
> Worse than that, if the virus is still attached, you're now sending it to
> someone who might not have otherwise received it. You're helping to
> spread the infection.
When I say bounce I mean reject. We try not to accept them. But
sometimes we end
On Fri, 19 Mar 2004, Antony Stone wrote:
> If you bounce the rest, you are sending unwanted and irrelevant emails to
> innocent users who didn't send anything to you, and who will regard your
> bounce messages basically as spam.
Worse than that, if the virus is still attached, you're now sending i
On Fri, 19 Mar 2004, Spike Ilacqua wrote:
> server). I think it has something to do with the particular message,
> because the same message will fail more than once if deferred by the
> milter.
Right, I saw single message from particular address rejected many times,
while other mail is accepted
On Fri, 19 Mar 2004, Nigel Horne wrote:
>
> > Mar 19 13:37:36 topaz clamav-milter[17382]: [ID 910239 mail.error] write
> > failure to clamd
>
> That reads to me that clamd has gone away
No, it's still alive, as I said, next mails are received properly.
Andrei Bucur says the same.
I've made some progress. The sendmail out of memory stuff is gone, but now
sendmail is complaining that the clmilter.sock is unsafe. I've Googled myself
into a tizzy, but can't find a fix.
These errors are in /var/log/maillog.
Mar 19 15:22:45 ciscy sendmail[18114]: i2JLMjNR018114: Milter (clmil
On Friday 19 March 2004 9:21 pm, Robert Schmidt wrote:
> We bounce messages that have viruses.
That sounds like a terrible idea.
The number of viruses which do not have forged sender addresses these days is
so small that you can ignore them.
If you bounce the rest, you are sending unwanted and
Robert Schmidt wrote:
It would be fine if the originating server never got the virus in the
first place, but we have to run ClamAV in an "accept on time-out" mode
in case the milter has disappeared, so it is quite possible that viruses
end up on the machine.
I don't have any problems with the mil
On Mar 19, 2004, at 05:17, Robert Blayzor wrote:
On 3/18/04 5:40 PM, "Doug Hardie" <[EMAIL PROTECTED]> wrote:
My quick look at the code behind --disable-urandom gave me the
impression that it only disabled the test for urandom and forced clamd
to use urandom. Thats why I manually deleted the def
On Friday 19 March 2004 21:51, Jim Maul wrote:
> > for spam and virus email) they will try to forward it on. The problem is
> > if that central server is using ClamAV it will bounce the message back
> > to the originating server.
> >
>
> Why are you bouncing mail back to the server?
Because he (
On Fri, 2004-03-19 at 12:51, Jim Maul wrote:
> > We tend to forward the postmaster account off our each of our mail
> > servers to other central servers that the admins read it on. If the
> > postmaster account receives a virus (they are fairly popular addresses
> > for spam and virus email) they w
Hello all,
I'm trying to set up clamd with multilog. I have followed the post
located on
http://www.mail-archive.com/[EMAIL PROTECTED]/msg06804.html,
but if I set LogFile to /dev/stdout and do a "svc -d /service/clamd ;
svc -u /service/clamd" I get a zombie process (Z flag in "ps ax"). If I
o
Pardon if this has been discussed in the archives. I searched on various
keywords with either no luck or too many hits to be useful.
I've installed clam 0.70RC and clam-mailter 0.70RC from the RPMs onto a system
running Fedora Core 1 with sendmail 8.12.10.
clamav runs fine, but when I put the m
On Friday 19 March 2004 23:12, Trog wrote:
> > > Tue Mar 16 18:52:25 2004 -> ERROR: accept() failed: Too many open files
> > > on 2.2 kernel and
> > >Thu Mar 18 18:06:06 2004 -> ERROR: pthread_create failed
> > > on 2.4 kernel
> update to .70rc or currrent CVS
Bug present in clamav-devel-2004031
On Saturday 20 March 2004 00:04, Sergey wrote:
> Fri Mar 19 23:43:44 2004 -> ERROR: ScanStream: Can't write to temporary file.
sorry, "temporary file" is my mistake.
--
Regards,
Sergey
---
This SF.Net email is sponsored by: IBM Linux Tutori
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Steve
> Schofield
> Sent: Friday, March 19, 2004 1:22 PM
> To: [EMAIL PROTECTED]
> Subject: [Clamav-users] qmail-scanner 1.21 and ClamAV .67 or .70
>
>
> I'm trying to get Q/S 1.21 and ClamAV working on F
It's in clamd. Compiled and running on RH 7.3.
Same behavior is shown on a couple of servers. Right now, RSS is at 366M,
it went all the way to 2.9GB on one of my servers before I noticed it.
It's being used to scan for viruses via MimeDefang.
Is this a known problem?
Config:
ArchiveMaxC
On Fri, 2004-03-19 at 17:33, Todd Lyons wrote:
> On Fri, 2004-03-19 at 01:41, Sergey wrote:
>
> > > On a stock RedHat 9.0 box (3 boxen load balanced) with updated kernel
> > > (2.4.20-20.9smp), I have stability problems with clamd.
> > Possible it's similar with my problem... What is in clamd.log
I'm trying to get Q/S 1.21 and ClamAV working on FreeBSD 4.9. I get the
following errors
I've verified the permissions on /var/spool/qmailscan, verified the
softlimit without success.
The clamd process is running when this error comes up. Any help would be
appreciated. Note the q/s 1.20 and clam
Okay,
so, how do I stop those messages ?
I don't know I did the first time :-((
I have the following parameters
$final_virus_destiny = D_DISCARD; # (defaults to D_BOUNCE)
#$warnvirussender = 1; # (defaults to false (undef))
Phil
Wolfgang Cernohorsky wrote:
pi wrote:
At this time, I'
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Robert
> Schmidt
> Sent: Friday, March 19, 2004 11:06 AM
> To: [EMAIL PROTECTED]
> Subject: [Clamav-users] Postmaster bounces and such.
>
>
> We tend to forward the postmaster account off our each of ou
On Fri, 2004-03-19 at 02:13, pi wrote:
> $virus_admin = "[EMAIL PROTECTED]"; # line 463
$virus_admin = '[EMAIL PROTECTED]';
> $mailfrom_notify_admin = "[EMAIL PROTECTED]"; # line496
> $mailfrom_notify_recip = "[EMAIL PROTECTED]"; # line497
> $mailfrom_notify_spamadmin = "[E
On Fri, 2004-03-19 at 01:41, Sergey wrote:
> > On a stock RedHat 9.0 box (3 boxen load balanced) with updated kernel
> > (2.4.20-20.9smp), I have stability problems with clamd.
> Possible it's similar with my problem... What is in clamd.log at this
> time ?
> I my logs:
> Tue Mar 16 18:52:25 200
I was seeing those to, they seem to go with a message:
clamav-milter[55529]: write failure to clamd
I added "--dont-scan-on-error" to the clamav-milter args, which stopped
the rejections, but obviously doesn't solve the underlying problem.
MaxThreads is 1000 and MaxConnectionQueueLength 100 (it
Thanks, I'll have a look at them ASAP.
-Nigel
On Friday 19 Mar 2004 3:01 pm, Korchmenuk Nickolay wrote:
> Hi
>
> On Thu, 18 Mar 2004 13:09:13 +
>
> Nigel Horne <[EMAIL PROTECTED]> wrote:
> > On Thursday 18 Mar 2004 7:23 am, Korchmenuk Nickolay wrote:
> > > I've 11 e-mails like that with SCO.A
We tend to forward the postmaster account off our each of our mail
servers to other central servers that the admins read it on. If the
postmaster account receives a virus (they are fairly popular addresses
for spam and virus email) they will try to forward it on. The problem is
if that central serv
Le Ven 19 mar 15:41:34 2004, Wolfgang Cernohorsky écrit:
> > At this time, I'd like the recipient to be warned of a quarantined mail.
> > I tried many things but I never succeeded to except if I also warn the
> > sender. (what I don't want)
>
> I think, today 99,9% of mails with viruses or worms
Try to increase the MaxThreads and MaxConnectionQueueLength values.
i did:
MaxThreads 25
MaxConnectionQueueLength 30
same error !
- Original Message -
From: "Tomasz Kojm" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 4:46 PM
Subject: Re: [Clamav-users] rejec
Hi
On Thu, 18 Mar 2004 13:09:13 +
Nigel Horne <[EMAIL PROTECTED]> wrote:
> On Thursday 18 Mar 2004 7:23 am, Korchmenuk Nickolay wrote:
> > I've 11 e-mails like that with SCO.A, Netsky, I-Frame.exploit etc.
> Please send to me, the more samples the better!
You can download samples from
www.ny
Hi
Thanks for your help.
However, last night I uninstalled clam, and installed as source.
The real problem is that the first time round I had not read the
instructions properly..doh!
Anyway the problem is now sorted.
Again thanks for your kind help.
David
Krištof Petr wrote:
david wrote:
On Fri, 19 Mar 2004 13:44:02 +
Nigel Horne <[EMAIL PROTECTED]> wrote:
>
> > Mar 19 13:37:36 topaz clamav-milter[17382]: [ID 910239 mail.error]
> > write failure to clamd
>
> That reads to me that clamd has gone away
Try to increase the MaxThreads and MaxConnectionQueueLength values.
--
pi wrote:
> At this time, I'd like the recipient to be warned of a quarantined mail.
> I tried many things but I never succeeded to except if I also warn the
> sender. (what I don't want)
I think, today 99,9% of mails with viruses or worms contain no usefull
information for our recipients, so t
yes that's it
thank u Sergey
- Original Message -
From: "Sergey" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 3:45 PM
Subject: Re: [Clamav-users] reject=451 4.7.1 Please try again later
> On Friday 19 March 2004 16:12, Andrei Bucur wrote:
>
> > when i recei
no ... it's alive -- that's the BIG problem !
- Original Message -
From: "Nigel Horne" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 3:44 PM
Subject: Re: [Clamav-users] reject=451 4.7.1 Please try again later
>
> > Mar 19 13:37:36 topaz clamav-milter[17382]: [I
On Friday 19 March 2004 16:12, Andrei Bucur wrote:
> when i receive bigger mails i got the folowing error:
>
> reject=451 4.7.1 Please try again later
>
> please help !
I write about it 25/02/2004 10:56. I not set purpose to check
all mails and I use --dont-scan-on-error
--
Regards,
Sergey
> Mar 19 13:37:36 topaz clamav-milter[17382]: [ID 910239 mail.error] write
> failure to clamd
That reads to me that clamd has gone away
-Nigel
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
-
On 3/18/04 5:40 PM, "Doug Hardie" <[EMAIL PROTECTED]> wrote:
> My quick look at the code behind --disable-urandom gave me the
> impression that it only disabled the test for urandom and forced clamd
> to use urandom. Thats why I manually deleted the define. I guess I
> will have to look a bit cl
Thanks for your answer.
I already began to receive "infected mails" ;-)
I put them in a special mailbox. It works perfectly.
At this time, I'd like the recipient to be warned of a quarantined mail.
I tried many things but I never succeeded to except if I also warn the
sender. (what I don't want
On Fri, 19 Mar 2004, Andrei Bucur wrote:
> when i receive bigger mails i got the folowing error:
>
> reject=451 4.7.1 Please try again later
I can see same things in my logs. It's sendmail
8.12.10+clamd+clamav-milter v 0.70-rc on Solaris9 (sparc).
It happens only for few sender adresses (always t
Hi,
when i receive bigger mails i got the folowing error:
reject=451 4.7.1 Please try again later
please help !
thank u
---
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and
On Fri, 19 Mar 2004 13:21:51 +0400
Sergey <[EMAIL PROTECTED]> wrote:
> Hello.
>
> I known what clamd have 2 bugs.
>
> I can't say more about first (I sent some
> information about it to bugs#clamav.net some
> days ago and to Nigel Horne today), but first
> explore second: some logged messages h
On Fri, 19 Mar 2004 11:01:55 +0100
"daniele" <[EMAIL PROTECTED]> wrote:
> with 0.68 all ok
> thanks
Please don't top-post.
The only technical problem with your old clamav version was the outdated
database.
--
oo. Tomasz Kojm <[EMAIL PROTECTED]>
(\/)\. http:
> -Original Message-
> From: pi [mailto:[EMAIL PROTECTED]
> Sent: Friday, March 19, 2004 11:13 AM
> To: [EMAIL PROTECTED]
> Subject: [Clamav-users] amavis installed, no more mails
>
>
> Hi,
>
> I try to use amavis with postfix.
> 1st try, no more mail transmitted to the local mailboxes so I
Hi,
I try to use amavis with postfix.
1st try, no more mail transmitted to the local mailboxes so I decide to configure
after trying to configure amavis for my domaine (wehowski.com), I can no more start
amavis.
here are the messages I receive when I try to start the service.
Starting Mail Virus
with 0.68 all ok
thanks
- Original Message -
From: "Thomas Lamy" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, March 18, 2004 11:49 AM
Subject: Re: [Clamav-users] SFX-RAR files
> daniele schrieb:
>
> > From: "Michael L Torrie" <[EMAIL PROTECTED]>
> >
> >>On Wed, 2004-03-17
Im using the latest ClamAv from CVS.
"2004-03-18"
How do I change so ClamAv either scans or removes
password protected zip files?
And is there anny solution out for the "RAR module
failure" ?
- Original Message -
From:
Jonathan Mergy
To: [EMAIL PROTECTED]
Sent:
On Friday 19 March 2004 04:45, Todd Lyons wrote:
> On a stock RedHat 9.0 box (3 boxen load balanced) with updated kernel
> (2.4.20-20.9smp), I have stability problems with clamd.
>
> I'm using sendmail -> clamav-milter -> clamd. Our mail servers accept
> about 50K mail per day (each box), of whi
Hello.
I known what clamd have 2 bugs.
I can't say more about first (I sent some
information about it to bugs#clamav.net some
days ago and to Nigel Horne today), but first
explore second: some logged messages have not
"\n". Log examples:
Thu Mar 18 18:06:06 2004 -> ERROR: pthread_create failedT
Thanks. The clamav way is fine w/me.
I can also go the amavisd route (glad I updated it a few days ago).
Which version for clamav ? I'm at .68-1
[EMAIL PROTECTED] mergy]$ clamscan -V
clamscan / ClamAV version 0.68-1
[EMAIL PROTECTED] mergy]$
jonathan mergy
[EMAIL PROTECTED]
65 matches
Mail list logo
