Re: [Snort-inline-users] Fwd: Clamav

[Victor J. <vi...@nk...>]

>
>
> I'll not be running snort_inline chrooted again. I thought it'd
> improve performance.
>
So without the -t option it still doesn't work?

Can you add and remove files from /clamscan manually? Have you tried
supplying a ordinary directory to the clamav preprocessor?

If that all doesn't work you can compile snort_inline in debug mode. You
do that by adding --enable-debug to ./configure.

Then, when you have rebuild snort_inline, you can run it like this:
export SNORT_DEBUG=67108864
snort_inline <all your normal args>

This will hopefully give some interesting output :-)


Regards,
Victor