[Avcheck] SuSE eMail Server 3.0

Michael Tokarev mjt@tls.msk.ru
Sun, 18 Aug 2002 23:31:57 +0400


[I'm not sure if you're subscribed]
Morten Christensen wrote:
> 
> I have avcheck 09pre and kavdaemon 4.0.1 running on a
> SuSE 8.0 server with postfix.
> 
> Now I have tried to install avcheck 0.90 and kavdaemon 4.0.1
> on a SuSE eMail server 3.0 in the same way.
> 
> When AVP Daemon is startet it says:
> loadbase: error in openbase ./defUnix.prf
> 3 times, but seems to start ok. I suppose, that this
> error-message is not a problem.

No, this is a problem, but unrelated.  Since kavdaemon can't read
it's settings, defaults will be used.

> I have used the manual test in readme.avp and
> administrator received a virus-alert mail.
> 
> But when I configure postfix with the lines in master.cf
> and writes content_filter=avcheck to main.cf through
> the email-server-web-interface, the mail-system stops
> working.
> 
> The message in /var/log/mail is
> 
> Aug 17 13:19:24 email postfix/master[498]: warning: process
> /usr/lib/postfix/pipe pid 1295 exit status 1
> Aug 17 13:19:24 email postfix/master[498]: warning:
> /usr/lib/postfix/pipe: bad command startup -- throttling
> Aug 17 13:19:24 email postfix/qmgr[1290]: warning: end of input while
> receiving string data from service private/avcheck
> Aug 17 13:19:24 email postfix/qmgr[1290]: warning: private/avcheck:
> malformed response

And this IS a problem, but it is logged few lines BEFORE the above
error messages in your mail log file.  It seems your pipe mail
delivery agent isn't configured properly.

> When content_filter=avcheck is commented out, mails start
> to pass through the system again but of cource without the
> needed antivirus-check.
> 
> Has anybody tried avcheck with eMail Server3.0

If this is postfix, the answer is - sure...

> or can help with the log-messages?

No, noone can help you with the above log messages.  Those are
the result of pipe(8) not working, but you didn't showed us the
reason *why* it wan't work.

What *postfix* version do you use?  I have only one small guess:
try looking up at your pipe(8) manpage and see if `q' flag is
there.  And, first of all, at the real error message.

/mjt