[Rspamd-Users] Antivirus patterns_fail and force_actions

Friedrichs, Jens jens.friedrichs at uni-leipzig.de
Thu Mar 18 06:24:13 UTC 2021


I had the same problem with the oletools and the use in a force action.
To solve this you can try to convert your force action from a prefilter to a postfilter.

Try to add following line to your force action:
require_action = ["no action", "greylist", "reject", "add header", "rewrite subject"];

best regards

-----Ursprüngliche Nachricht-----
Von: Users <users-bounces at lists.rspamd.com> Im Auftrag von Zbynek Jun via Users
Gesendet: Mittwoch, 17. März 2021 23:20
An: Users at lists.rspamd.com
Cc: Zbynek Jun <postmaster at junix.cz>
Betreff: [Extern] [Rspamd-Users] Antivirus patterns_fail and force_actions


	i redefined symbol name for some antivirus fail states in antivirus.conf

  patterns_fail {
    # symbol_name = "pattern";
    SOPHOS_FAILED = '^failed to scan and retransmits exceed$';

and added coresponding section in force_actions.conf

    action = "soft reject";
    expression = "SOPHOS_FAILED";
    message = "Rejected due to temporary system problem";

but symbol seems to be unknown for force_action module

# rspamadm configtest
cannot find dependency on symbol SOPHOS_FAILED for symbol FORCE_ACTION_SOFT_REJECT_VIRUS_SCAN_FAIL

and also antivirus module logs some complaints.

proxy; lua_task_insert_result_common: symbol insertion issue: unknown symbol SOPHOS_FAILED; trace: [1]:{/usr/share/rspamd/lualib/lua_scanners/common.lua:110 - yield_result [Lua]}; [2]:{/usr/share/rspamd/lualib/lua_scanners/sophos.lua:118 - <unknown> [Lua]};

Adding symbols to antivirus_group.conf did not help.

Any hints ?


Zbynek J.
Users mailing list
Users at lists.rspamd.com

More information about the Users mailing list