[Mimedefang] Installed FPScan and it's just hanging and then timing out.

[mimedefang at bass-speaker.com]

Thanks Steffan,

Changing the call's to fpscan to include
"--nospin </dev/null"
Fixes the issue , seems that --nospin doesn't have any effect (left it in anyway), it's the </dev/null that does. 

Have tested it with against those pesky blank MS macros, and it's detecting and dropping as desired :)

The 2 lines read as 
For Procedure :  entity_contains_virus_fpscan 

run_virus_scanner($Features{'Virus:FPSCAN'} . " --report --archive=5  --scanlevel=4 --heurlevel=3 --nospin </dev/null $path 2>&1");


and in message_contains_virus_fpscan

run_virus_scanner($Features{'Virus:FPSCAN'} . " --report --archive=5  --scanlevel=4 --heurlevel=3 --nospin </dev/null ./Work 2>&1");

Thanks and Regards,

Mack.


-----Original Message-----
From: MIMEDefang [mailto:mimedefang-bounces at lists.roaringpenguin.com] On Behalf Of Steffen Kaiser
Sent: 05 February 2016 06:47
To: mimedefang at lists.roaringpenguin.com
Subject: Re: [Mimedefang] Installed FPScan and it's just hanging and then timing out.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 4 Feb 2016, mimedefang at bass-speaker.com wrote:

> F-PROT Antivirus for Linux Workstations - 1 user
> #9    Corporate Use    Subscription

is there a fpscand executable shipped with? That's the demon and is more performant, however, you might run in access permissions problems, if it does not run as root or, if used with MimeDefang only, as the Defang user.

> my($lclscannertwocode, $lclscannertwocategory, $lclscannertwoaction) = 
> message_contains_virus_fpscan();
>
> then mimedefang does indeed start the virus scanner, but it just seems 
> to hang for about 10mins and then times out I guess
>
> here is the result from ps -ef for the scan
>
> defang   23812 22632  0 20:11 ?        00:00:00 /usr/local/bin/fpscan
> --report --archive=5 --scanlevel=4 --heurlevel=3 ./Work

First(ly), I would try to patch mimedefang.pl in sub message_contains_virus_fpscan () to include "--nospin </dev/null" as option to fpscan. --nospin disables the progress bar and </dev/null disables interactivity.

And if the problem persists prefix the while command with "strace -f -o /tmp/strace.fp.$$ " or similiar for your system.
So you could see at which point the problem comes up and which syscall it is. Maybe add one of -r, -t, -tt, -ttt and/or -T near -f.

> root at mailserver01a:/var/spool/MIMEDefang/mdefang-u14KBLch023801# cat 
> /proc/23812/stack
>
> [<ffffffff811c6ba1>] pipe_wait+0x61/0xa0

does this mean, fpscan is blocked on write? Maybe --nospin helps here.

> This is now beyond my scope I think, I tried this :

That's the test.pl, right?
Try to run it without an terminal attached, e.g.

nohup perl test.pl & wait

Use the same shell (sh, bash, tcsh, dash, ...) that starts the MIMEDefang demon.

- --
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEVAwUBVrRFfVGgR0+MU/4GAQKezggAq6b8dspxrK9n2cJc3Yr0tk0HBa0saCP0
PJM4l2yoMLz3V10oKOOoCcOabWMBDfjl6gIteISCUdYRE4lpOKa5pFRBwyCaFpAU
Pl700fkGqwfVDW7VKsjs6RsknBlGac2qLDKoFawMLEcO9tALlAUXMnLMCXeSrlOp
7QIoQJOEfcXKW46coYpubMwrySLMXHi/nbcGZ7CqliCLb2OIbkWQZ3vkfIrCWrZE
mMK7BMiEU+Q+LmgnYt4eVk9EabL2ug5EyxqgODYMK3QVtznEcaVR0p0fnwNc1Q2X
H+wg5sSX0UxZeMuOgGcGv3WTTA/U0wNp+nIjv85lxsKL0l4n2OIm6A==
=hSFV
-----END PGP SIGNATURE-----
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID.  You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

This Email Has Been Anti-Virus Scanned