problem with amavis and nod32

Hi!

I'm having a slight problem with my amavisd-new
installation. I'm using 
the nod32 av scanner with amavis, and sometimes mails
generate such 
error logs:

Jun 18 11:26:32 zeusz amavis[9766]: (09766-07) (!!) run_av
(ESET 
Software NOD32 Command Line Interface v 2.52) FAILED -
unexpected exit 
3, output="... 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> part000.txt: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME:
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 
-> MIME -> part000.txt: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME:
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 
-> MIME -> : 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> part000.txt: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> part001.htm: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> szoke.pps: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> : info="error occurred while reading
archive""

Jun 18 11:26:32 zeusz amavis[9766]: (09766-07) (!!) ESET
Software NOD32 
Command Line Interface v 2.52 av-scanner FAILED:
/usr/bin/nod32cli 
unexpected exit 3, output="... 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> part000.txt: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME:
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 
-> MIME -> part000.txt: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME:
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 
-> MIME -> : 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> part000.txt: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> part001.htm: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> szoke.pps: 
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
MIME -> : info="error occurred while reading
archive"" at (eval 44) line 
462.


I contacted nod32 support and they suggested that it's
amavis' fault 
("it could happen with open source softwares"),
because it can not 
extract the mail properly. They suggested leaving out amavis
from the 
delivery chain, but thats clearly not an option for us.

Any suggestions?

------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Gregorics Tamás wrote the following on 6/18/2007 7:01 AM
-0800:
> Hi!
>
> I'm having a slight problem with my amavisd-new
installation. I'm using 
> the nod32 av scanner with amavis, and sometimes mails
generate such 
> error logs:
>
> Jun 18 11:26:32 zeusz amavis[9766]: (09766-07) (!!)
run_av (ESET 
> Software NOD32 Command Line Interface v 2.52) FAILED -
unexpected exit 
> 3, output="... 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> part000.txt: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME:
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 
> -> MIME -> part000.txt: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME:
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 
> -> MIME -> : 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> part000.txt: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> part001.htm: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> szoke.pps: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> : info="error occurred while reading
archive""
>
> Jun 18 11:26:32 zeusz amavis[9766]: (09766-07) (!!)
ESET Software NOD32 
> Command Line Interface v 2.52 av-scanner FAILED:
/usr/bin/nod32cli 
> unexpected exit 3, output="... 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> part000.txt: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME:
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 
> -> MIME -> part000.txt: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME:
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 
> -> MIME -> : 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> part000.txt: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> part001.htm: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> szoke.pps: 
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 -> 
> MIME -> : info="error occurred while reading
archive"" at (eval 44) line 
> 462.
>
>
> I contacted nod32 support and they suggested that it's
amavis' fault 
> ("it could happen with open source
softwares"), because it can not 
> extract the mail properly. They suggested leaving out
amavis from the 
> delivery chain, but thats clearly not an option for
us.
>
> Any suggestions?
>   

If you set amavisd to send the raw e-mail to nod32, do you
still see the 
error?

Bill

------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Gregorics,

> I'm having a slight problem with my amavisd-new
installation. I'm using
> the nod32 av scanner with amavis, and sometimes mails
generate such
> error logs:
>
> Jun 18 11:26:32 zeusz amavis[9766]: (09766-07) (!!)
run_av (ESET
> Software NOD32 Command Line Interface v 2.52) FAILED -
unexpected exit
> 3, output="...
[...]
>
cleann/var/lib/amavis/tmp/amavis-20070618T112128-09766/part
s/p010 ->
> MIME -> : info="error occurred while reading
archive""

The nod32cli entry in av_scanners declares status 0 as ok,
1 and 2 as infected, anything else is an error:
  [0], [1,2]

If nod32cli is returning status 3, and you consider it not
an error,
you may add the 3 to the first (clean) or the second
(infected) list
of status values, e.g:
  [0,3], [1,2]

> I contacted nod32 support and they suggested that it's
amavis' fault
> ("it could happen with open source
softwares"), because it can not
> extract the mail properly. They suggested leaving out
amavis from the
> delivery chain, but thats clearly not an option for
us.

If you run nod32cli on the parts/p010 file (which looks
like
some kond of an archive), are you saying that it does not
return
a status 3?

  Mark

------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Tamás,

> I contacted nod32 support and they suggested that it's
amavis' fault
> ("it could happen with open source
softwares"), because it can not
> extract the mail properly. They suggested leaving out
amavis from the
> delivery chain, but thats clearly not an option for
us.

Actually, (funny!), the status 3 was removed from the clean
list
in 2.5.1, because we substituted our nod32cli entry with
the
one provided in the NOD32 documentation!

I'll revert the change in 2.5.2:

- updated AV entry for ESET NOD32 Linux Mail Server again -
command line
  interface (nod32cli): added status 3 (e.g. corrupted
archive) back to
  the list of clean statuses;  the 3 was removed in 2.5.1 as
the entry
  was substituted with the one from a NOD32 documentation;
reported by
  Tamás Gregorics;

amavisd-new-2.5.1 release notes

- updated AV entry for ESET NOD32 Linux Mail Server -
command line
  interface (nod32cli), version 2.7, thanks to Simon;


Mark

------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/