[Clamav-users] Notifications

2006-04-06 Thread Greg McCarthy
I am trying to setup clamav-milter to only notify the postmaster when a virus is detected. I'm using the below: /usr/local/sbin/clamav-milter --max-children=20 -olb local:/var/run/clamav/clamav-milter.sock --postmaster-only [EMAIL PROTECTED] The postmaster does get notified, but the sender also r

Re: [Clamav-users] Notifications

2006-04-06 Thread Nigel Horne
> I am trying to setup clamav-milter to only notify the postmaster when > a virus is detected. I'm using the below: > > /usr/local/sbin/clamav-milter --max-children=20 -olb > local:/var/run/clamav/clamav-milter.sock --postmaster-only > [EMAIL PROTECTED] > > The postmaster does get notified, but the

Re: [Clamav-users] Scanning large mails occupies very large memory

2006-04-06 Thread Nick Leverton
On Wednesday 05 April 2006 18:25, Daniel T. Staal wrote: > On Wed, April 5, 2006 1:08 pm, Rob MacGregor said: > > WTF are you doing accepting email's at 200 MB? There are far more > > appropriate methods of file transfer than SMTP! > > But they all require more complicated and lasting setups than

[Clamav-users] clamscan and file access times

2006-04-06 Thread Miner, Jonathan W \(CSC\) \(US SSA\)
Hi - I've just started to use ClamAV as part of an evaluation of several anti-virus products for our UNIX/Linux networks. Our primary need is to scan filesystems. The first thing I noticed was that there was no option to preserve file access times, this is a problem for me, since we have archi

Re: [Clamav-users] clamscan and file access times

2006-04-06 Thread James Kosin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Miner, Jonathan W (CSC) (US SSA) wrote: > Hi - > > I've just started to use ClamAV as part of an evaluation of several > anti-virus products for our UNIX/Linux networks. Our primary need > is to scan filesystems. The first thing I noticed was that th

RE: [Clamav-users] clamscan and file access times

2006-04-06 Thread Miner, Jonathan W \(CSC\) \(US SSA\)
>Miner, Jonathan W (CSC) (US SSA) wrote: >> Hi - >> >> I've just started to use ClamAV as part of an evaluation of several >> anti-virus products for our UNIX/Linux networks. Our primary need >> is to scan filesystems. The first thing I noticed was that there >> was no option to preserve file ac

Re: [Clamav-users] clamscan and file access times

2006-04-06 Thread James Kosin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Miner, Jonathan W (CSC) (US SSA) wrote: > >> Hi, >> >> Clamscan shouldn't be modifying the (modification time)... The >> access time should be OK being modified; otherwise you would >> backup/etc every time someone viewed a file. > > Clamscan does no

RE: [Clamav-users] clamscan and file access times

2006-04-06 Thread Miner, Jonathan W \(CSC\) \(US SSA\)
> No confusion. I just read your statement and looked at the code and > your code resets both the modified time and the accessed time for the > file. The utime() system call sets both access and modification times at the same time. If you were to only set one value, the other would be undefi

Re: [Clamav-users] Scanning large mails occupies very large memory

2006-04-06 Thread Nick Leverton
On Thursday 06 April 2006 19:17, Karolis Dautartas wrote: > > Agreed, especially since ClamAV is a general virus-scanning tool and > > not specifically for email. > > while sending emails of that size and scanning them for viruses is > definately not the best idea, being unable to scan large files

[Clamav-users] Re: clamscan and file access times

2006-04-06 Thread Virgo Pärna
On Thu, 6 Apr 2006 10:39:07 -0400, Miner, Jonathan W (CSC) wrote: > The utime() system call sets both access and modification times at the = > same time. If you were to only set one value, the other would be = > undefined, possibly ZERO! You need to use lstat() to read both values, = > prior to

RE: [Clamav-users] Re: clamscan and file access times

2006-04-06 Thread Miner, Jonathan W \(CSC\) \(US SSA\)
> Virgo Pärna says: > > What about ctime - this would cause change in ctime value. I'll take your word for it; I have not tested that. > I'm using AIDE (Advanced Intrusion Detection System) to monitor > my systems and among the things that AIDE saves to it's database > is file's ctime - if it

Re: [Clamav-users] clamscan and file access times

2006-04-06 Thread Jeffrey T Eaton
> I've just started to use ClamAV as part of an evaluation of several = > anti-virus products for our UNIX/Linux networks. Our primary need is to = > scan filesystems. The first thing I noticed was that there was no option = > to preserve file access times, this is a problem for me, since we have

RE: [Clamav-users] clamscan and file access times

2006-04-06 Thread Miner, Jonathan W \(CSC\) \(US SSA\)
> Jeffrey T. Eaton says: > > This patch opens a possible race condition where a legitimate change > to the file won't result in the modification time being updated. Good catch... Thanks! Sounds like you would need to do a second lstat() call, and them compare the mtimes. If the mtimes are equal