HTTP Anti-Virus Proxy

Hey all,

1> I get an error saying

"A virus scanner error occurred
while scanning
Input/Output error "

while downloading from the following link http://filecompress.altervista.org/Down ... =UHARC.EXE
i couldn't figure out what is the problem exactly.

2> My download automatically stops after approximately 10 MB.

MAXSCANSIZE 0
KEEPBACKBUFFER 200000
are set in my config
So any suggestion for smooth download for non infected files?

any help will be appreciated....
Thank you,

Regards,
Piyush

That error comes when ClamAV fails to access the tempfile for some reason..

Are you sure you are not running out of temp space?
Only problem with that file?
Does it always stop at 10MB?

Cheers,
Henrik

Hello, thanks for reply,

I have solved the error by incresing the partition size.

Now can you suggest me what should be my cache partition size if i have 2 Mbps connection with about 50 users.

I use HAVP with Squid as a parent proxy, are my contents being cached in both squid as well as HAVP? If yes then what should be optimal solution?

--Piyush--

HAVP does not cache anything, Squid is for that purpose.

You could have anything from 2 to 20GB to cache size. More you have, more you might save bandwidth. But you will see a limit at some point and the cache usage does not grow, resulting in wasted space if it's too big. Naturally it also depends how you configure the refresh algorithms in Squid. But this and other info you can find from Squid manuals and mailing lists.

Cheers,
Henrik

Hello,

Thanks for quick reply.

I have set my squid cache size to 2 GB and i'm also using separate partition for HAVP.

Now my requirement is to scan files upto 1 GB not more than that. So I have doubts regarding scanning process of HAVP.

1>Is HAVP scan progressively? If I set 500 MB as a HAVP partition then what should be my KEEPBACKBUFFER and MAXSCANSIZE option set.

2>If I set KEEPBACKBUFFER to 10 MB then what should be my HAVP partition size?

3>How HAVP partition size affects the size of file being scanned, i mean does HAVP stores all content in temp and start scanning or it scans-sends data if it is clear as per KEEPBACKBUFFER option.

4> The data in KEEPBACKBUFFER size get scanned irrespective of scanning speed?
for example: if I have KEEPBACKBUFFER 20 MB and I download file of 35 MB containing virus at 19 MB. My scanning speed is slow so I reach to 20 MB of file before scanner can and the file contaning virus at 19 MB is sent to browser. Is it the case? or it is sure that data within KEEPBACKBUFFER is scanned?


Please help me regarding this....I'm a bit confused..really

Thanks
Piyush

The tempfile will grow and grow while HAVP is scanning. You cannot scan 1GB if you don't have the space (atleast 5GB would be needed because several users might be getting big files). I would not even bother scanning that big files, it doesn't offer that much benefit and takes lots of CPU power. In my opinion, clients workstation scanner should take care of looking into those huge files and not slowing down HAVP.

If I had 500MB space, I would set MAXSCANSIZE to 20-50MB maximum, depending on how many users you have.



They have no relation.. KEEPBACKBUFFER only tells how much to hold back from browser. It doesn't make much sense to go over 1MB. Your users will appreciate not waiting so long for transfer to start..



It is (quite) clearly told in documentation.. downloaded file is written to disk until MAXSCANSIZE is reached. Scanning is done while it is downloading.



In that case browser will never receive the last 20MB, until file is FULLY scanned and verified. Then the last part is sent. But again, it is silly to have such big buffer. It does not really offer any advantages, except that user can get virus error page on big files (0-20MB size). I rather have quick dynamic scanning with 0.5-1MB buffer.

Cheers,
Henrik