Re: [AMaViS-user] Virus scanner log reporting

Bill,

> I am using custom log reporting ($log_temp1) in my amavisd.conf; however, I
> am having a difficult time trying to come up with the proper syntax to
> report virus scanners detecting a virus and the virus name the scanner
> reported. I am looking for a format as follows:
> Scanner1 detected virus-name1
> Scanner2 detected virus-name2
> Scanner3 detected virus-name3

Such logged information is not available off-the-shelf
and the log template is not flexible enough to provide it.

You will have to hack the code, or make use of a log entry:

(85916-06-2) virus_scan: (W32/Sober-Z), detected by
3 scanners: Sophie, Sophos SAVI, ClamAV-clamd

or parse the more detailed entries:

(85916-06-2) ask_av (Sophie) result: 1:W32/Sober-Z
(85916-06-2) ask_av (Sophie): /var/amav.../parts INFECTED: W32/Sober-Z

(85916-06-2) ask_av (Sophos SAVI) result: W32/Sober-Z FOUND
(85916-06-2) ask_av (Sophos SAVI): p004 INFECTED: W32/Sober-Z

(85916-06-2) ask_av (ClamAV-clamd) result:
/var/ama../parts/p004: Worm.Sober.U FOUND\n
(85916-06-2) ask_av (ClamAV-clamd): /var/ama../parts INFECTED: Worm.Sober.U


Mark


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/...fo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/