[Exim] Problems with Exiscan 4.12-21 and Sophos AV

Top Pagina
Delete this message
Reply to this message
Auteur: Marcelo Moreira
Datum:  
Aan: exim-users
Onderwerp: [Exim] Problems with Exiscan 4.12-21 and Sophos AV
I just recently (2 days ago) upgraded my Exim 4.10 to Exim 4.12.
Obviously, I also upgraded Exiscan to 4.12-21.

Amazingly, all my deliveries began to fail.
The relevant output of exim -d is as follows...

====================
Data file written for message 18YDTx-0002aq-00
calling exiscan(); timeout=900
exiscan: starting
exiscan: untrue exiscan_extension_condition
exiscan: using command line scanner. Path: /usr/local/bin/sweep,
Options: -all -archive -ss |
exiscan: calling scanner as '/usr/local/bin/sweep -all -archive -ss
/var/spool/exim/scan/18YDTx-0002aq-00'
exiscan: error reading from child process (scanner output): No child
processes
LOG: REJECT
exiscan: temporary local problem (error reading from child process
(scanner output): No child processes)
exiscan: unlinking
/var/spool/exim/scan/18YDTx-0002aq-00/18YDTx-0002aq-00-complete
exiscan: unlinking /var/spool/exim/scan/18YDTx-0002aq-00/textfile0
exiscan() returned 5 temporary local problem (error reading from child
process (scanner output): No child processes)
LOG: MAIN REJECT
temporarily rejected by exiscan(): temporary local problem (error reading
from child process (scanner output): No child processes)
====================

It drove me crazy for over 2 days now, but I finaly found something...

On the file exiscan.c, if the AV does not return any output (sweep will
return nothing under the -ss option, unless there is a virus), then exiscan
considers an error and exits.

I remove the -ss from the options line, and everything is working fine now,
but sweep returns a bunch of information, that will have to be eventualy
parsed by exiscan.

Did anybody else face this problem ? Are my sweep options fine
(-all -archive -ss), or does anybody else suggests anything better ? Also,
does anybody recommends something else (better?) than Sophos AV ? What about
clamd ?

Thanks,
M.