Re: ac_scanner = $acl_m0

On Wed, Jan 05, 2005 at 01:22:03PM +0000, David Cannings wrote:
> [email protected] wrote:
> > twice ... found by UVSCAN ?!?!?
> > scanned two time with same av_scanner ?
> > error in printing message ?
> > who can help please
> 
> The result from the malware condition is cached, I assume this is the
> problem here.  I know of no way to force it to be ignored though I
> assume there is one.

There are probably more elegant ways of doing it, but you
can set another ACL variable when the first scanner finds
something, then only check the second scanner if the
variable isn't set:

  # clamd
  warn  log_message = $acl_m2
        set acl_m0 = clamd:127.0.0.1 3310
        malware = *
        set acl_m2 = clamscan detected $malware_name

  # uvscan
  warn  log_message = $acl_m2
        condition = ${if !def:acl_m2{1}{0}}
        set acl_m0 = cmdline : \
                    /usr/local/uvscan/uvscan --secure --mime --analyze %s :\
                    Found|password:\
                    Found the (.+) .+
        malware = *
        set acl_m2 = uvscan detected $malware_name

-- 
Kyle Dippery
Engineering Computing Services		Phone: (859) 257-1346
280 Anderson Hall                   Fax:   (859) 323-3848
University of Kentucky
Lexington, KY  40506-0046