> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Todd Lyons
> Sent: dinsdag 8 maart 2005 0:23
> To: 'ClamAV users ML'
> Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
>
>
> Mark wanted us
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Robert Blayzor
> Sent: maandag 7 maart 2005 15:39
> To: ClamAV users ML
> Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
>
>
> I'll give it
Mark wanted us to know:
>Yesterday, I subjected ClamAV to a very rigorous, final
>stress test. I let it scan roughly 20,000 news spool files,
>and opened an individual connection for each file (not very
>efficient, of course, but good to get massive concurrency;
>especially since I ran 5 simultane
Trog wrote:
> Assuming I'm reading it right, I think it should be the other way
> around. Error strings look like:
>
> Reason ERROR
Ok, patched that in, thanks for pointing that out. I was basing it on
old clamdscan error string output.
--
Robert Blayzor, BOFH
INOC, LLC
rblayzor\@(inoc.net|gm
Le Lun 7 mar 09:38:30 2005, Robert Blayzor écrit:
> $err = $1 if ($r =~ /^ERROR\:(.*)/);
die "$1\n" if $r =~ /(.*) ERROR$/;
You may also remove the starting "stream: ".
___
http://lurker.clamav.net/list/clamav-users.html
On Mon, 2005-03-07 at 09:38 -0500, Robert Blayzor wrote:
> $err = $1 if ($r =~ /^ERROR\:(.*)/);
Assuming I'm reading it right, I think it should be the other way
around. Error strings look like:
Reason ERROR
-trog
signature.asc
Description: This is a digitally signed message part
___
Trog wrote:
> I hope your script handles ERROR responses correctly :-)
I'll give it a whirl, and yes, I seem to have it trapping error
conditions. (unless something changed, this always worked)
eval {
local $SIG{ALRM} = sub { die "Stream timeout"; };
alarm $sc{TIME_OUT};
while(<$csock>) {
On Mon, 2005-03-07 at 08:48 -0500, Robert Blayzor wrote:
> Ahh you are correct, that's what it does. Regardless, I know it's
> working correctly as it has worked fine for over a year now. Like I
> said, recently in 0.83 we've seen it hang up a few times. Both times
> I've been able to check the
Trog wrote:
> In that case it should be:
>
> connect 1:
> send: STREAM\n
> waitfor: PORT \d+
> connect 2: localhost:(port)
> dump message
> close connect 2:
> wait for response
> close connect 1:
>
> (notice the "close connect 2" moved up)
Ahh you are correct, that's what it does. Regardless,
On Mon, 2005-03-07 at 13:36 +, Mark wrote:
>
> Seemed like a pretty legitimate question to me. The PDF manual
> says close to nothing about SESSION/END, and certainly does not
> speak of a "pause". In fact, if "pause" is really meant, in the
> manner you quote, then this would be a horridly s
Trog wrote:
> On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
> > Trog wrote:
> > > You can't send multiple commands. You *must* follow the following
> > > sequence:
> > >
> > > send: SESSION
> > > pause
> > > send: SCAN /my/file
> > > read reply
> > > send: SCAN /my/file2
> > > read re
On Mon, 2005-03-07 at 08:23 -0500, Robert Blayzor wrote:
> No, not in the same connection, one scan per connection, multiple
> connections. ie:
>
> connect 1:
> send: STREAM\n
> waitfor: PORT \d+
> connect 2: localhost:(port)
> dump message
> wait for response
> close connect 2:
> close connect
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Steve Platt
> Sent: maandag 7 maart 2005 12:00
> To: ClamAV users ML
> Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
>
>
> [EMAIL PROTECTED] sa
Trog wrote:
> You can't send multiple commands. You *must* follow the following sequence:
>
> send: SESSION
> pause
> send: SCAN /my/file
> read reply
> send: SCAN /my/file2
> read reply
No, not in the same connection, one scan per connection, multiple
connections. ie:
connect 1:
send: STREAM\
Trog wrote:
> On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
> > Trog wrote:
> > > You can't send multiple commands. You *must* follow the following
> > > sequence:
> > >
> > > send: SESSION
> > > pause
> > > send: SCAN /my/file
> > > read reply
> > > send: SCAN /my/file2
> > > read reply
On Monday 07 Mar 2005 12:08, Julian Mehnle wrote:
> Trog wrote:
> > send: SESSION
> > pause
>
> What's "pause" supposed to mean?
From my dictionary:
pause: interval of inaction or silence; break made in speech or
reading.
Mind you my dictionary was written before the days of the Internet.
--
On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
> Trog wrote:
> > You can't send multiple commands. You *must* follow the following
> > sequence:
> >
> > send: SESSION
> > pause
> > send: SCAN /my/file
> > read reply
> > send: SCAN /my/file2
> > read reply
>
> What's "pause" supposed to
Trog wrote:
> You can't send multiple commands. You *must* follow the following
> sequence:
>
> send: SESSION
> pause
> send: SCAN /my/file
> read reply
> send: SCAN /my/file2
> read reply
What's "pause" supposed to mean?
___
http://lurker.clamav.net/
[EMAIL PROTECTED] said:
> I can also not say I understand why ClamAV would hang on STREAM, and not on
> SCAN
Your STREAM problem may be different of course.
The messages that gave our clamd a hard time would do exactly the same for
clamscan ( "of course" ). I just wanted you to check that you
On Fri, 2005-03-04 at 11:59 -0500, Robert Blayzor wrote:
> Trog wrote:
> > What software are you using to do stream scanning? It is switched off by
> > default in clamav-milter 0.83
>
>
> I'm using a PERL script that is taking the messages and stream scanning
> them with clamd. It's been running
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Steve Platt
> Sent: vrijdag 4 maart 2005 16:40
> To: ClamAV users ML
> Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
>
>
> I paraphrase; but t
Trog wrote:
> What software are you using to do stream scanning? It is switched off by
> default in clamav-milter 0.83
I'm using a PERL script that is taking the messages and stream scanning
them with clamd. It's been running fine for many months with various
versions of clamd. I've just only r
On Fri, 2005-03-04 at 09:05 -0500, Robert Blayzor wrote:
> We have some fairly busy mail servers that seem to run clamd fine for
> days, and sometimes weeks, but since we moved to ClamAV 0.83 twice now
> we've noticed that stream scanning, on rare occasions, starts to hold
> connections and timeout
Robert,
Do your mail logs show what came in just before the problems occurred (twice)?
It might just be that it falls into a class of email messages that cause
clamav ( > 0.81 ) to go into hyperspace, examining each bit individually from
every point in five dimensions before giving the message
24 matches
Mail list logo
