[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    Re: ClanAV.pm Plugin Not Working
From:       David B Funk <dbfunk () engineering ! uiowa ! edu>
Date:       2015-11-19 1:09:37
Message-ID: alpine.LSU.2.03.1511181903130.20092 () engineering ! uiowa ! edu
[Download RAW message or body]

On Wed, 18 Nov 2015, dans wrote:

> spamassassin version: 3.4.1 running on FC 22
>
> Anti spam functions running file.  I want to use the ClamAV.pm plugin.
> clamav.pm and clamav.cf are installed in /etc/mail/spamassassin.
> File::Scan::ClamAV was installed via CPAN.
>
> Every file scanned returns a hash error in the X-Spam-Virus header line.
> Here is a scan of my test message which contains eicar:
>
> spamc -l </somemessage.txt
>
> X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on myhost
> X-Spam-Level:
> X-Spam-Status: No, score=0.1 required=1.0 tests=BAYES_00,MISSING_DATE,
>        MISSING_MID,NO_RECEIVED,NO_RELAYS,TAB_IN_FROM autolearn=no
> autolearn_force=no
>        version=3.4.1
> X-Spam-Virus: Error (File::Scan::ClamAV=HASH(0x3a092c8)->errstr())
> From:   me@me.com
> To:        you@you.com
> Subject: Test
>
> This is a spam test.
>
> X5O!P%@AP[4\PZX54(P^)7CC)7}$[REDACTED]EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
>
> So no matter what the file I get the Error with a hash value.  A rescan will
> provide a different hash value.
>
> Suggestions please?

Have you used the ClanAV.pm plugin successfully in a previous SA kit?
There are some requirements that must be satisfied (must have a clamd running
on the same machine as  spamd, File::Scan::ClamAV perl module, etc).

What corresponding errors are being logged by your spamd?
What if anything is being logged by your clamd? (you may need to
turn up the logging level in your clamd).


-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
[prev in list] [next in list] [prev in thread] [next in thread]