(how-to) sophossavi installation guide

Questions and answers about how to do stuff
Post Reply
nicola.piazzi
Posts: 257
Joined: 23 Apr 2015 09:45

(how-to) sophossavi installation guide

Post by nicola.piazzi » 01 Apr 2019 14:29

Adding an antivirus to Efa / MailScanner means to add a cpu intensive process that is inaccettable for me
I found that without antivirus each messages takes about 3 / 5 sec/cpu to be processed for spam
Adding an antivirus can take additional 5 / 15 sec/cpu
So total server Cpu increase a lot and can be inaccettable

Only clamd and sophossavi have a daemon that runs in memory and are cpu inexpensive
clamd is included in efa instalaltion
sophossavi was difficoult to use because was written in 32bit and is undocumented
I wrote these simple instructions to install and use it

Please note that i am talking of sophossavi and not sophos option in MailScanner.conf
If someone try this can tell me about it
Attachments
EFA.SophosSavi_Install_Centos6_64.zip
(1.78 KiB) Downloaded 24 times

uzisuicida
Posts: 4
Joined: 24 Jan 2019 06:24

Re: (how-to) sophossavi installation guide

Post by uzisuicida » 02 Apr 2019 19:34

I'm going to try it, and I'll tell you how it goes.

nicola.piazzi
Posts: 257
Joined: 23 Apr 2015 09:45

Re: (how-to) sophossavi installation guide

Post by nicola.piazzi » 09 Apr 2019 08:08

Sophos SAVI works well
Cattura.PNG
Cattura.PNG (24.66 KiB) Viewed 157 times

mac.linux.free
Posts: 28
Joined: 31 May 2015 20:37

Re: (how-to) sophossavi installation guide

Post by mac.linux.free » 09 Apr 2019 13:05

works for me, too. :clap:

nicola.piazzi
Posts: 257
Joined: 23 Apr 2015 09:45

Re: (how-to) sophossavi installation guide

Post by nicola.piazzi » 09 Apr 2019 13:22

this is great because antivirus not daemonized are unusable for me

before i used clamav and sophos

changing to sophosavi i reduced efa vm from 12 to 4 cpu !

musabr187
Posts: 10
Joined: 24 Sep 2018 06:02

Re: (how-to) sophossavi installation guide

Post by musabr187 » 16 Apr 2019 08:24

Hi Nicola,

It’s working. Thanks for your document.
How did you add Sophos SAVI on Virus report? It’s not showing up in scanner column.

nicola.piazzi
Posts: 257
Joined: 23 Apr 2015 09:45

Re: (how-to) sophossavi installation guide

Post by nicola.piazzi » 16 Apr 2019 08:28

Nothing done in virus report, if you dont see i suppose you havent received viruses detected by savi at now

musabr187
Posts: 10
Joined: 24 Sep 2018 06:02

Re: (how-to) sophossavi installation guide

Post by musabr187 » 16 Apr 2019 09:19

It's not catching test virus 'EICAR-AV-Test' on the report.

nicola.piazzi
Posts: 257
Joined: 23 Apr 2015 09:45

Re: (how-to) sophossavi installation guide

Post by nicola.piazzi » 16 Apr 2019 09:22

EICAR CATCH is excluded by report, you need to include it modifiyng source or wait to receive virus

musabr187
Posts: 10
Joined: 24 Sep 2018 06:02

Re: (how-to) sophossavi installation guide

Post by musabr187 » 16 Apr 2019 09:26

Okay, thanks. Waiting for virus :)

nicola.piazzi
Posts: 257
Joined: 23 Apr 2015 09:45

Re: (how-to) sophossavi installation guide

Post by nicola.piazzi » 16 Apr 2019 09:29

i modified report but i dont remember where

if you have echange consider to use OW plugin

musabr187
Posts: 10
Joined: 24 Sep 2018 06:02

Re: (how-to) sophossavi installation guide

Post by musabr187 » 16 Apr 2019 09:35

Okay, I'll check it out later.

musabr187
Posts: 10
Joined: 24 Sep 2018 06:02

Re: (how-to) sophossavi installation guide

Post by musabr187 » 17 Apr 2019 04:24

Password protected zip file is blocked by SophosSAVI '.zip caused an error: File was encrypted (530)', where I need to change to disable this.

nicola.piazzi
Posts: 257
Joined: 23 Apr 2015 09:45

Re: (how-to) sophossavi installation guide

Post by nicola.piazzi » 17 Apr 2019 09:21

somewhere there is this, buit for me is ok so

musabr187
Posts: 10
Joined: 24 Sep 2018 06:02

Re: (how-to) sophossavi installation guide

Post by musabr187 » 17 Apr 2019 09:25

/etc/MailScanner/MailScanner.conf

##Allowed Sophos Error Messages =
Allowed Sophos Error Messages = "File was encrypted", "Password protected file"

This will allow encrypted/password protected files to pass.

Post Reply