[exim] av_scanner with Sophos / savscan

Hi,

does anybody use Sophos as av_scanner?

I tried to do it like this, but eicar testfile is not detected.

Exim Config:

*************

av_scanner = $acl_m4    # (because uf multiple av_scanner ACLs)

 deny  set acl_m4     = cmdline:\
                        /opt/sophos-av/bin/savscan -ss -all -rec -archive %s:\
                        found in file:'(.+)'
       malware        = */defer_ok
       message        = found malware ($malware_name)

*************

Sophos logs the scan, but no detection.

When scanning manually with savscan, the eicar testfile is detected and logged.

In the next acl, eicar is always detected by ClamAV.

Any ideas why savscan does not work as expected?

Regards,

Matze