[clamav-users] making clamdscan noisier when it has found something

[Charles Swiger]

On Feb 12, 2016, at 8:22 AM, Gene Heskett <gheskett at wdtv.com> wrote:
> So this is a feature request:
> 
> When clamdscan is used to filter an incoming email, it will find the 
> From: or Reply To: lines, possibly before it finds a reason to cause 
> that mail to be dumped.
> 
> So, how much trouble would it be to clear a buffer for each of those 2 
> header lines, with a Reply-To: taking precedence, and if something is 
> found, output the  last From: or Reply-to: information at the same time 
> it logs the FOUND msg?

What you're asking for is the responsibility of your mail scanning software.

clamdscan doesn't filter email.  In fact, usually clamdscan isn't provided
the mail envelope headers to scan at all, just the body or even just the
MIME attachments after the email body has been decoded and unpacked.

(If you're rolling your own mail scanner via procmail, well, look at the exit
status of clamdscam and output the headers you want to see.  But things like
amavisd already do good job of interfacing between the MTA and virus scanners.)

Regards,
-- 
-Chuck