Re: [AMaViS-user] amavisd-new and mcafee's uvscan for unix questions

[jonathan <jen...@ry...>]

aha: I'm not seeing the directory name in my ps list due to the 
command-line printout cutoff, which conveniently chops off right after 
/var/amavis/tmp/.  Increasing my amavis loglevel shows the correct 
directory being scanned.

I'm still not sure why I don't see a corresponding increase in the 
number of uvscan processes if I increase my number of amavisd processes 
by a factor of 2 or 3.  I have servers that are getting a queue backlog, 
yet are only showing 40% cpu utilization and lots of free memory, which 
seems strange.



MrC wrote:
> jonathan wrote:
>> My amavisd.conf is using a standard configuration for uvscan:
>>
>>    ### http://www.nai.com/
>>    ['NAI McAfee AntiVirus (uvscan)', 'uvscan',
>>      '--secure -rv --mime --summary --noboot - {}', [0], [13],
>>      qr/(?x) Found (?:
>>          \ the\ (.+)\ (?:virus|trojan)  |
>>          \ (?:virus|trojan)\ or\ variant\ ([^ ]+)  |
>>          :\ (.+)\ NOT\ a\ virus)/,
>>    # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'},
>>    # sub {delete $ENV{LD_PRELOAD}},
>>    ],
>>
>> I'm running many instances of amavisd, yet I never seem to see much more 
>> than  a dozen uvscan processes, no mater how many amavisd processes are 
>> running.  Furthermore, it seems like every uvscan process is scanning 
>> the entire contents of /var/amavisd/tmp?:
>>
>>   amavisd  6265  6112   1 15:57:36 ?           0:07 
>> /usr/local/bin/uvscan --secure -rv --mime --summary --noboot - 
>> /var/amavis/tmp/
>>
>> Shouldn't each uvscan process be shown as acting on a single 
>> subdirectory (message) in amavisd/tmp?  I'm seeing really high times for 
>> virus scanning.
> 
> Yes, it should be a per-mail message, which gets decoded into a specific
> folder in the amavis tmp directory.  I'm seeing:
> 
> /bin/sh /usr/local/bin/uvscan --secure -rv --mime --summary \
>   --noboot - /var/spool/amavis/tmp/amavis-20080813T135331-1
> 
>> Any insight here greatly appreciated.
> 
>