Request- keep scan files around on error

I have a quarantine router/transport for this, but of course it means you 
can't reject at SMTP time. The "no_more" means that it doesn't get delivered.

acl_check_mime:

warn  set acl_m1  = ${extract{-1}{.}{${lc:$mime_filename}}}
warn  message     = X-Rdg-Executable: $acl_m1
        condition   = ${if match{$acl_m1}{\N^(vbs|vbe|wsf|wsh|js|jse|exe|com|cmd|shs|hta|bat|scr|lnk|pif)$\N}{1}{0}}

..

acl_check_content:

..

# Reject virus infested messages.
  warn  message = X-Rdg-Infected: $malware_name
        malware = *

..

begin routers

# Quarantine malware
exiscan_quarantine:
  driver    = accept
  transport = quarantine
  condition = ${if or{{def:h_X-Rdg-Infected:}{def:h_X-Rdg-Executable:}}{1}{0}}
  no_more
  no_verify

..

begin transports

# This transport quarantines suspect messages
quarantine:
  driver = appendfile
  file = /var/exim/exiscan/virusmails/${message_id}-complete
  message_suffix =
  message_prefix =
  user = exim
  group = exim

...

Hope this helps,

Chris

On Tue, 10 Aug 2004 12:44:49 -0700 (PDT) Scott Call <[email protected]> 
wrote:

> I get:
> Tue Aug 10 09:43:45 2004 -> 
> /var/spool/exim/scan/1BuZiy-0003ZY-LY/1BuZiy-0003ZY-LY-00000.zip: Zip 
> module failure ERROR
> 
> Anywhere from 5-50 times a day in my clamd log (and an equivalent entry in 
> the exim paniclog).
> 
> What I'd like to do is have the option to tell  exiscan not delete the 
> /var/spool/exim/scan/xxx files for messages when there's an error like 
> that.
> 
> I'd like to make sure I'm not killing legit messages.  I know the error is 
> in clam, but since exiscan is managing the droped files, I figured it 
> would be the place to look to at least save a copy and try to figure out 
> why it's having trouble,
> 
> Thanks
> -S
> 
> 
> Scott Call	Router Geek, ATGi, home of $6.95 Prime Rib
> I make the world a better place, I boycott Wal-Mart 
> VoIP incoming: +1 360-382-1814
> 
> 
> 

--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+--
Christopher Wakelin,                                [email protected]
IT Services Centre, The University of Reading,       Tel: +44 (0)118 378 6630
Whiteknights, Reading, RG6 2AF, UK                   Fax: +44 (0)118 975 3094