Re: [exim] Need help with exiscan and generic command line s…

Top Page
Delete this message
Reply to this message
Author: Ralf G. R. Bergs
Date:  
To: exim-users
Subject: Re: [exim] Need help with exiscan and generic command line scanner interface
On 2013-09-22 22:15 , Ralf G. R. Bergs wrote:
> On 2013-09-22 20:09 , Jeremy Harris wrote:
>> On 18/09/13 14:08, Ralf G. R. Bergs wrote:
>>>>    warn  message         = This message contains malware
>>>> ($malware_name)
>>>>          set acl_m0      = cmdline:/usr/lib/AntiVir/guard/avscan -s
>>>> --batch --scan-mode=all %s; /bin/echo -e \N"\navira_retval
>>>> $?"\N:\N^avira_retval 1$\N:\N.*ALERT: ([^;]*) ;.*\N
>> I suspect that just setting acl_m0 to that string doesn't do what you
>> think.  Have a look at

>>
>> http://exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html
>>
>>
>> - maybe it should be involved with the av_scanner global option,
> Actually I do use this already -- I left it out for briefness.
>> but I doubt the bit with "echo" will work there.
> As I said the other three scanners are working just fine, and I'm
> already using a similar construct (i. e. the below fragment does work
> well!):
>>  warn  message         = This message contains malware ($malware_name)
>>         set acl_m0      = cmdline:\
>>                           /usr/bin/avgscan --arc %s; echo -e
>> \N"\navg_retval $?"\N:\
>>                           avg_retval 5:\
>>                           \NVirus identified *(.*)$\N
>>         malware         = *
>>         log_message     = This message contains malware
>> (avg:$malware_name)
> Any idea why the below is not working?
>>   warn  message         = This message contains malware ($malware_name)
>>         set acl_m0      = cmdline:/usr/lib/AntiVir/guard/avscan -s
>> --batch --scan-mode=all %s; /bin/echo -e \N"\navira_retval
>> $?"\N:\N^avira_retval 1$\N:\N.*ALERT: ([^;]*) ;.*\N
>>         malware         = *
>>         log_message     = This message contains malware
>> (avira:$malware_name)

Any idea, anyone?

KR,

Ralf