[Snort-inline-users] Fwd: Fwd: Clamav

[<per...@gm...>]

---------- Forwarded message ----------
From: Victor Julien <vi...@nk...>
Date: Nov 4, 2006 4:59 PM
Subject: Re: [Snort-inline-users] Fwd:  Clamav
To: Francisco Mu=F1oz <per...@gm...>
Cc: sno...@li...

>
>
> I'll not be running snort_inline chrooted again. I thought it'd
> improve performance.
>
So without the -t option it still doesn't work?

No, doesn't work, still drops all packets.

Can you add and remove files from /clamscan manually? Have you tried
supplying a ordinary directory to the clamav preprocessor?

I can add and remove files manually as an ordinary user to /clamscan

I don't know how to supply a ordinary directory to the clamav preprocessor.

If that all doesn't work you can compile snort_inline in debug mode. You
do that by adding --enable-debug to ./configure.

Then, when you have rebuild snort_inline, you can run it like this:
export SNORT_DEBUG=3D67108864
snort_inline <all your normal args>

This will hopefully give some interesting output :-)

Ok, i'll do it and post my findings.


Regards,
Victor

Thanks a lot.

--=20
Regards,
Francisco