Re: [AMaViS-user] amavisd-new and mcafee's uvscan for unix questions

[MrC <lis...@ca...>]

jonathan wrote:
> My amavisd.conf is using a standard configuration for uvscan:
> 
>    ### http://www.nai.com/
>    ['NAI McAfee AntiVirus (uvscan)', 'uvscan',
>      '--secure -rv --mime --summary --noboot - {}', [0], [13],
>      qr/(?x) Found (?:
>          \ the\ (.+)\ (?:virus|trojan)  |
>          \ (?:virus|trojan)\ or\ variant\ ([^ ]+)  |
>          :\ (.+)\ NOT\ a\ virus)/,
>    # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'},
>    # sub {delete $ENV{LD_PRELOAD}},
>    ],
> 
> I'm running many instances of amavisd, yet I never seem to see much more 
> than  a dozen uvscan processes, no mater how many amavisd processes are 
> running.  Furthermore, it seems like every uvscan process is scanning 
> the entire contents of /var/amavisd/tmp?:
> 
>   amavisd  6265  6112   1 15:57:36 ?           0:07 
> /usr/local/bin/uvscan --secure -rv --mime --summary --noboot - 
> /var/amavis/tmp/
>
> Shouldn't each uvscan process be shown as acting on a single 
> subdirectory (message) in amavisd/tmp?  I'm seeing really high times for 
> virus scanning.

Yes, it should be a per-mail message, which gets decoded into a specific
folder in the amavis tmp directory.  I'm seeing:

/bin/sh /usr/local/bin/uvscan --secure -rv --mime --summary \
  --noboot - /var/spool/amavis/tmp/amavis-20080813T135331-1

> 
> Any insight here greatly appreciated.