HTTP Anti-Virus Proxy

Hi

Im using version 0.81 and managed to kill my server (Fedora Core 2).

Im pretty certain it was because I only had a 1Gb available in /var/tmp/havp and I tried to scan a file larger than 1Gb

I created /var/tmp/havp by the following commands

dd if=/dev/zero of=/var/havp.fs bs=1MB count=1000
mkfs.ext3 /var/havp.fs
mount /var/havp.fs /var/tmp/havp -o loop,mand

In fact it was a file that was gzipped up. So zipped it was only 100Mb.

Can I check the MAXSCANSIZE applies to the zipped file size? I guess it wouldnt know how big the unzipped file was untill it had unzipped it.

Cheers

Paul

MAXSCANSIZE only knows the original (zipped) size. It's what you receive from server.

Then you have scanner which does the extracting (TEMPDIR usually). Perhaps you run out of space there.

In any case you should see some errors?

Cheers,
Henrik

Thanks for the response.

Im trying to figure out where the virus scanner (kaspersky) would unpack the file.

In the aveserver.log file it suggests its in the /var/tmp/havp directory

[28-06-2006 13:02:51 A] [30764] Scan progress: /var/tmp/havp/havp-9lRhtw/eicar_com.zip/eicar.com INFECTED EICAR-Test-File

Is my interpretation correct? so I just need to make sure theres loads of space in the /var/tmp/havp directory?

Also kaspersky version 5.5 doesnt seem to have an aveserver component so im testing this with kaspersky version 5.0, is 5.5 supported?

Thanks

Paul

I don't think it unpacks it there.. I would guess it uses /tmp or /var/tmp. I don't have kaspersky at hand now, but I would imagine it can be set in it's config file.

Aveserver is required, other stuff doesn't matter. So you have some 5.5 version that doesn't have it. Linux File and Mail Server should have it.

Cheers,
Henrik

Thanks again for the reply.

Yep it looks like kav unpacks files in /tmp which had plenty of space so i dont think that caused my problem.

Also ive downloaded kav 5.5 fileserver and it didnt have an aveserver component, I cant seem to find an up to date version of kaspersky which has it, although reading the changelogs it makes no mention of its removal.

Ill just carry on using version 5.0 for now.

Thanks

Paul