Clamav log

kilgore · Unread post by **kilgore** » Sat Jan 15, 2005 10:06 am

Dear,

I've recently installed Clamav + SA on a new Plesk 7.1.6 Reloaded server and I want to be sure that virus are really detected (SA works well).

Is there a log file or something else that could tell me if Clamav is working fine ? (/var/log/clamav/clamd.log just tell me that clamd is running ...)

Thanks for your help,

Kilgore

Unread post by **scott** » Sat Jan 15, 2005 4:49 pm

assuming youre using qmail-scanner, look at /var/spool/qmailscan/quarantine.log

kilgore · Unread post by **kilgore** » Sat Jan 15, 2005 7:49 pm

Here is an parts of my quarantine.log file :

Sun, 16 Jan 2005 00:45:24 CET **********@tiscali.fr bofa@********** Sanchez Disallowed breakage found in header name - potential virus spamassassin: 3.0.1. perlscan: 1.24st.
Sun, 16 Jan 2005 00:47:20 CET **********@tiscali.fr ledi@*********** You`ve got 1 VoiceMessage! PIF files not allowed per Company security policy spamassassin: 3.0.1. perlscan: 1.24st.

Why is not clamd mentionned ? (only SA and perlscan)

Thanks for your attention,

Kilgore

Unread post by **scott** » Sat Jan 15, 2005 8:05 pm

Id say because it wasnt detected when you installed it

kilgore · Unread post by **kilgore** » Sun Jan 16, 2005 7:07 am

Thanks, that's the reason why I was asking.

In fact my qmail-scanner-reconfigure wasn't working (it wasn't ending). I've found the problem this morning : my server is configured in french and the reconfigure script was asking if I want to use the english language instead but the script wasn't showing me this question... I've shoot the /dev/null output redirection and everything is solved now.

Best regards,

Kilgore

Unread post by **scott** » Sun Jan 16, 2005 12:33 pm

ah, useful info for anyone else that runs into this. Ive heard about it happening from time to time, good to know what the root cause is.