On Sun, Nov 05, 2006 at 07:47:08AM -0800, Andrew Sackville-West wrote: > On Sun, Nov 05, 2006 at 08:22:13AM -0500, Jim Seymour wrote: > > On Sat, Nov 04, 2006 at 12:39:47PM -0800, Andrew Sackville-West wrote: > > > > > > FTR, this is what I did for testing and have never bothered to change: > > > > > > warn malware = * > > > message = WARNING! Virus! ($malware_name) > > > > > I tried this just as you are using it to no avail. It just looks like > > clamav is looking for messages in the wrong place. Any ideas? > > can you watch it with top and see if clam is getting called at all? > you should see clam cpu usage spike a bit. also do you have any clam > logs? > > I"m stumped. Its probably something annoyingly obvious like maybe a > typo. > > Have you checked to see that the clamd socket exists > (/var/run/clamav/clam.ctl?)? > > umm.... > > what I don't know is whether there is a way to manually connect to > clamd say by piping a message to it or something like that. THat might > be helpful, but wouldn't know how. > > sorry, no help > > A
Hi, It finally came to life. May have been something else, however this was my last change. The directory /var/spool/exim4/scan/ had permissions set to 770 however /var/spool/exim4 had permissions of 750. I did a chmod 770 on /var/spool/exim4 and another test sending from my yahoo account with the eicar text in the body was picked up and bounced back to my yahoo account :-) Thanks for the suggestions all. It really did help narrow it down. Thanks, Jim -- I started using something better than the "standard" back when IBM advertised OS/2 Warp on TV. As Linux matured I made the transition from OS/2 v4 to Linux. You don't have to accept less than you deserve. "Use the Power of the Penguin" Registered Linux user #316735 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
