ClamAV & Kerio

[saym101]

Установил этот антивирус. Обновил базы. Демон работает, но керио ни хочет с ним работать. Сначала не видел, потом добавил в конфиг

Код: [Выделить]

TCPSocket 3310
TCPAddr 127.0.0.1Увидел. Но заругался что не может проверить тестовый вирус еикар и отваливает его подальше.
Вот логи керио

[10/Nov/2010 21:28:04][9241] {avir} Configuration value of ShortTimeout for Antivir: 60 s
[10/Nov/2010 21:28:04][9241] {avir} Configuration value of LongTimeout for Antivir: 120 s
[10/Nov/2010 21:28:04][22946] {avir} unable to recieve msg header, pipe closed
[10/Nov/2010 21:28:04][22946] {avir} recvThread() is stopped
[10/Nov/2010 21:28:04][22952] {avir} sendThread() is stopped
[10/Nov/2010 21:28:04][9241] {avir} killServer() server is killed
[10/Nov/2010 21:28:04][9241] {avir} ClientDispatcher::stop() server killed
[10/Nov/2010 21:28:04][9241] {avir} ClientDispatcher::stop() all reqs are terminated
[10/Nov/2010 21:28:04][9241] {avir} ClientDispatcher::stop() all proxies are unregistered
[10/Nov/2010 21:28:04][9241] {avir} forkServer() going to create server process
[10/Nov/2010 21:28:04][9241] {avir} forkServer() server process created, waiting for connection with server
[10/Nov/2010 21:28:04][9241] {avir} forkServer() server is running, creating send and recv. thread
[10/Nov/2010 21:28:04][24539] {avir} recvThread() is started
[10/Nov/2010 21:28:04][9241] {avir} Maximum of scanning threads is set to 8
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Initializing Clam AntiVirus plug-in...
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Startup timeout is set to 90
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Sending SESSION command...
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Session initialized.
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Sending PING command...
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Sending VERSION command...
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Version: ClamAV 0.96.3/12231/Wed Nov 10 16:15:17 2010
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Sending END command...
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Session finished.
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: The engine has been initialized
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Initializing context
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Sending SESSION command...
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Context initialized
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: Scanning file /opt/kerio/mailserver/store/tmp/eicar.tmp...
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: INSTREAM size limit exceeded. ERROR
[10/Nov/2010 21:28:04][24539] {avir} ClamAV_plugin: File scanning result: Scanning failed - ClamD returns error: INSTREAM size limit exceeded.
[10/Nov/2010 21:28:04][9241] {avir} Detection of test virus EICAR failed
[10/Nov/2010 21:28:04][9241] {avir} sendThread() is already stopped
[10/Nov/2010 21:28:04][9241] {avir} Server: plugin avir_clammt failed to start.
[10/Nov/2010 21:28:04][9241] {avir} Configuration value of ShortTimeout for Antivir: 60 s
[10/Nov/2010 21:28:04][9241] {avir} Configuration value of LongTimeout for Antivir: 120 s

Антивирусник по времени только одна запись

Код: [Выделить]

WARNING: INSTREAM: Size limit reached, (requested :68, max: 0)StreamMaxLength в конфиге стоит ноль. Пробовал ставить побольше, мож в нем дело. Не помогает.

Нашел правда вот это

INSTREAM
It is mandatory to prefix this command with n or z.
Scan a stream of data. The stream is sent to clamd in chunks, after INSTREAM, on the
same socket on which the command was sent. This avoids the overhead of establishing
new TCP connections and problems with NAT. The format of the chunk is: <length>
<data> where <length> is the size of the following data in bytes expressed as a 4 byte
unsigned integer in network byte order and <data> is the actual chunk. Streaming is
terminated by sending a zero-length chunk. Note: do not exceed StreamMaxLength as
defined in clamd.conf, otherwise clamd will reply with INSTREAM size limit exceeded and
close the connection.

Подходит под мою ошибку. Гугль переводчик не прояснил не чего. Что с этим делать хз.

[Karl500]

У меня в /etc/clamav/clamd.conf стоит

root@bowmore:~# cat /etc/clamav/clamd.conf | grep Stream
StreamMaxLength 10M

Но никак не 0...

[saym101]

Не помогло. Все одно пишет

Код: [Выделить]

Engine avir_clammt failed to start: Detection of test virus EICAR failedПользователь решил продолжить мысль 12 Ноября 2010, 16:21:53:Победил сию беду. Может кому поможет.
Исправил в конфиге, по умолчанию там было
StreamMaxLength 0
Исправил на
StreamMaxLength 16M

Заработало.