1 Topic by beez (edited by beez 2011-06-11 00:04:18)

  • beez
  • Member
  • Offline
  • Registered: 2011-06-09
  • Posts: 27

Topic: [SOLVED] Cannot view/release quarantined virus

Hello, for some reason I'm unable to view and/or release quarantined virus from the iredadmin panel,
I can see the sample virus email being quarantined in the mysql database,
and iredadmin shows the number of quarantined, but its unclickable and not showing in the quarantine list (only spam)

the quarantined spam works fine (viewable and releaseable)

Post's attachments

quarantine.png
quarantine.png 5.83 kb, 1 downloads since 2011-06-10 

You don't have the permssions to download the attachments of this post.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,135

Re: [SOLVED] Cannot view/release quarantined virus

Reference: http://iredmail.org/wiki/index.php?titl … ining.SPAM

You must configure Amavisd to quarantine VIRUS into MySQL database first. In /etc/amavisd.conf:

#
# Quarantine VIRUS into MySQL.
#
$virus_quarantine_to = 'virus-quarantine';           # <- Remove '#' at the beginning of line.
$virus_quarantine_method = 'sql:';           # <- Remove '#' at the beginning of line.

These 6 quarantined VIRUS are stored in /var/amavis/, you can delete them manually (via command "rm") or release/delete them via command "amavisd-release".

3 Reply by beez

  • beez
  • Member
  • Offline
  • Registered: 2011-06-09
  • Posts: 27

Re: [SOLVED] Cannot view/release quarantined virus

ZhangHuangbin wrote:

You must configure Amavisd to quarantine VIRUS into MySQL database first. In /etc/amavisd.conf:

#
# Quarantine VIRUS into MySQL.
#
$virus_quarantine_to = 'virus-quarantine';           # <- Remove '#' at the beginning of line.
$virus_quarantine_method = 'sql:';           # <- Remove '#' at the beginning of line.

My amavisd configuration is already like that, and I've restarted the amavisd service,
and like I said, I can see the quarantined virus email directly from mysql, and the admin panel show the # of quarantined virus,
but I'm still unable to click on the Virus # from the iredadminpro mysql panel,and the quarantine list doesn't show the quarantined virus email (only the spam).

How to make the admin panel list the quarantined virus mail (like the one in the demo panel, the virus # is clickable and linked to quarantine)

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,135

Re: [SOLVED] Cannot view/release quarantined virus

Quarantined VIRUS and SPAM are listed in same page. If you already have VIRUS quarantined into MySQL, then you can view them in "https://your_domain.com/iredadmin/activ … uarantined".

5 Reply by beez

  • beez
  • Member
  • Offline
  • Registered: 2011-06-09
  • Posts: 27

Re: [SOLVED] Cannot view/release quarantined virus

ZhangHuangbin wrote:

Quarantined VIRUS and SPAM are listed in same page. If you already have VIRUS quarantined into MySQL, then you can view them in "https://your_domain.com/iredadmin/activ … uarantined".

The VIRUS is already quarantined into MYSQL as I can see them directly using mysql-client in the table amavisd.quarantine
but I'm still unable to view them from the https://your_domain.com/iredadmin/activ … uarantined as it's only listing the SPAM messages, but not the VIRUS

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,135

Re: [SOLVED] Cannot view/release quarantined virus

- What are the subjects of these VIRUS mails? You can find them in MySQL database.
- Can you find them in quarantined list with iRedAdmin-Pro (/activities/quarantined)?
- Can you find them in /var/amavis/?

7 Reply by beez

  • beez
  • Member
  • Offline
  • Registered: 2011-06-09
  • Posts: 27

Re: [SOLVED] Cannot view/release quarantined virus

- What are the subjects of these VIRUS mails? You can find them in MySQL database.

in table amavisd.msgs
select mail_id,subject,policy,size,content,quar_type,quar_loc,message_id from msgs where quar_type='Q' and content='V';
mail_id      | subject    | policy  | size | content | quar_type | quar_loc     | message_id
pyqpfOF6JxQk | test eicar | MYUSERS |  695 | V       | Q         | pyqpfOF6JxQk | <4DEF497C.6070304@domain>

in table amavisd.quarantine the mail_id changed into hpTfICXa6XaV for the same message

- Can you find them in quarantined list with iRedAdmin-Pro (/activities/quarantined)?

no, only listing the SPAM messages

- Can you find them in /var/amavis/?

no

8 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,135

Re: [SOLVED] Cannot view/release quarantined virus

beez wrote:

- What are the subjects of these VIRUS mails? You can find them in MySQL database.

in table amavisd.msgs
select mail_id,subject,policy,size,content,quar_type,quar_loc,message_id from msgs where quar_type='Q' and content='V';
mail_id      | subject    | policy  | size | content | quar_type | quar_loc     | message_id
pyqpfOF6JxQk | test eicar | MYUSERS |  695 | V       | Q         | pyqpfOF6JxQk | <4DEF497C.6070304@domain>

in table amavisd.quarantine the mail_id changed into hpTfICXa6XaV for the same message

That's the problem. iRedAdmin-Pro expects amavisd stores same mail_id in table "msgs" and "quarantine", so it can't correctly display these mails in /activities/quarantined.

Could you please share related mail records with me? one is enough. so that i can improve it to make it work.

9 Reply by beez (edited by beez 2011-06-10 23:52:55)

  • beez
  • Member
  • Offline
  • Registered: 2011-06-09
  • Posts: 27

Re: [SOLVED] Cannot view/release quarantined virus

My mistake, apparently I pasted the wrong line from amavisd.msgs

I found out that both msgs and quarantine do have the same mail_id,
but iredadmin still not listing the VIRUS quarantine.

does it have something to do with the virus # being unclickable in the statistic pane from the iredadmin dashboard?


edit: after browsing thru the admin panel sources,
I found out that the default template doesn't put link to /activities/quarantined for numberOfVirusMails
I think thats why the Virus # is unclickable,
After I add link to quarntine (copied from spammail) i can click it now.

I think it has something to do with the adminpanel templates that my quarantinedVIRUS mail doesn't get listed in the /activities/quarantined page

10 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,135

Re: [SOLVED] Cannot view/release quarantined virus

Got it fixed.
In file "libs/amavisd/quarantine.py", about line 155:

                    msgs.content IN ('S', 's', 'Y')

Please append 'V' here. Modifed line is:

                    msgs.content IN ('S', 's', 'Y', 'V')

Restarting Apache is recommended.

Thanks very much for your feedback, new versions of iRedAdmin-Pro will be available TOMORROW (2010-06-11).

11 Reply by beez

  • beez
  • Member
  • Offline
  • Registered: 2011-06-09
  • Posts: 27

Re: [SOLVED] Cannot view/release quarantined virus

                    msgs.content IN ('S', 's', 'Y', 'V')

Thanks, that fixed it smile

12 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,135

Re: [SOLVED] Cannot view/release quarantined virus

beez wrote:

Thanks, that fixed it

Great, did you try to delete or release the VIRUS mails?

13 Reply by beez

  • beez
  • Member
  • Offline
  • Registered: 2011-06-09
  • Posts: 27

Re: [SOLVED] Cannot view/release quarantined virus

ZhangHuangbin wrote:
beez wrote:

Thanks, that fixed it

Great, did you try to delete or release the VIRUS mails?


Yeah, both works fine smile

14 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,135

Re: [SOLVED] Cannot view/release quarantined virus

Great, thanks for your help. smile

15 Reply by beez

  • beez
  • Member
  • Offline
  • Registered: 2011-06-09
  • Posts: 27

Re: [SOLVED] Cannot view/release quarantined virus

Hey ZhangHuangbin,

I noticed another minor Issue with deleting all quarantined msg from the database.
It only deletes quarantined spam and ignores the virus mail,


self.db.delete('msgs', where="""quar_type='Q' AND content='S'""")
in /libs/amavisd/quarantine.py::281

16 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,135

Re: [SOLVED] Cannot view/release quarantined virus

beez wrote:

self.db.delete('msgs', where="""quar_type='Q' AND content='S'""")
in /libs/amavisd/quarantine.py::281

Fixed. You can change it to:

self.db.delete('msgs', where="""quar_type='Q'""")

Thanks very much for your feedback. smile