HTTP Anti-Virus Proxy

Hi, I'm using HAVP 0.81 with clamav 0.88.2.
I noticed that scan temp files are not deleted after used, so there is a
leak into the directory owning them.
Is it a configuration problem or a known bug?

Thanks,
Ernesto Del Prete

How do you mean, after used?

While HAVP is running, the same tempfiles are always reused.

When HAVP is closed, they should disappear. If not, then there is something wrong.

Cheers,
Henrik

Hi,
I executed a fuser on the temp files and only some of the thousands I have are currently used by a process. I mean "used" as not ownded by a havp process serving a connection.
I post my conf file. The problem arised when I switched to the 0.80 version (now I have the 0.81 and the problem is not solved) and only for the transparent proxy.

USER havp
GROUP havp
PIDFILE /var/run/havp/havp_transparent.pid
SERVERNUMBER 10
MAXSERVERS 150
ACCESSLOG /var/log/havp_transparent/access.log
ERRORLOG /var/log/havp_transparent/havp.log
SCANTEMPFILE /var/tmp/havp/transparent/havp-XXXXXX
DBRELOAD 60
DAEMON true
TRANSPARENT true
PARENTPROXY localhost
PARENTPORT 3128
LOG_OKS true
FORWARDED_IP false
PORT 8081
SOURCE_ADDRESS 127.0.0.1
DISPLAYINITIALMESSAGES true
TEMPLATEPATH /opt/havp_transparent/etc/havp/templates/it
WHITELIST /opt/havp_transparent/etc/havp/whitelist
BLACKLIST /opt/havp_transparent/etc/havp/blacklist
MAXSCANSIZE 0
KEEPBACKBUFFER 25000
TRICKLING 0
ENABLECLAMLIB true
ENABLECLAMD false
ENABLEFPROT false
ENABLEAVG false
ENABLEAVESERVER false
ENABLESOPHIE false
ENABLETROPHIE false
ENABLENOD32 false
ENABLEAVAST false

What OS/distribution/gcc version do you have?

Cheers,
Henrik

Fedora core 3

Linux server4 2.6.9-1.667smp #1 SMP Tue Nov 2 14:59:52 EST 2004 i686 i686 i386 GNU/Linux

I noticed that the daemons die.

Bye,
Ernesto

in addition:
the same configuration but without transparent proxy is ok.

I forgot the gcc version:

gcc (GCC) 3.4.2 20041017 (Red Hat 3.4.2-6.fc3)

Nothing in error logs?

Check some PID of "middle" process with "ps -fe --forest". And let "strace -p PID" run until it crashes. Probably won't take long if you have that many dead files around.. maybe this will give some clues.

Cheers,
Henrik

gotcha! the problem was the log file too big.
Is it possibile to send logs to syslog?

Bye,
Ernesto

if you want I can contribute to modify code to insert some issues.
HAVP is very useful for us.

Bye,
Ernesto del Prete

Gotta fix logging to be a bit more robust it seems.

We'll see if syslog can be added too.

Cheers,
Henrik

Yes, syslog logging would be usefull. It should be simple to do this.

I'm coding...

Bye,
Ernesto