Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: ClamAV: users

Is there any way for clamscan to only print infected files but also show errors?

 

 

ClamAV users RSS feed   Index | Next | Previous | View Threaded


Carlo.DiCocco at dfs

Aug 14, 2012, 7:25 AM

Post #1 of 3 (474 views)
Permalink
Is there any way for clamscan to only print infected files but also show errors?

I don't want to list every file clamscan checks (because there are many).
When I use the "-i" option to only print infected files, my scan summary
results indicate there were errors. However, the errors are not reported
because the "-i" option was used. Is there any way to only print infected
files but also show errors? I have already tried outputting the stderr
buffer to a file, but it's empty.

_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


draynor at sourcefire

Aug 14, 2012, 8:04 AM

Post #2 of 3 (469 views)
Permalink
Re: Is there any way for clamscan to only print infected files but also show errors? [In reply to]

On Tue, Aug 14, 2012 at 10:25 AM, <Carlo.DiCocco [at] dfs> wrote:

>
> I don't want to list every file clamscan checks (because there are many).
> When I use the "-i" option to only print infected files, my scan summary
> results indicate there were errors. However, the errors are not reported
> because the "-i" option was used. Is there any way to only print infected
> files but also show errors? I have already tried outputting the stderr
> buffer to a file, but it's empty.
>
> _______________________________________________
> Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
> http://www.clamav.net/support/ml
>

Carlo,

I noticed that myself when trying to debug some issues earlier this year. I
added this feature enhancement as bug #5350. With the new design, the "-o"
command-line option will tell clamscan to suppress OK results, so that both
infected and error results are printed. That feature will be included in
version 0.98.

Dave R.

--
---
Dave Raynor
Sourcefire Vulnerability Research Team
draynor [at] sourcefire
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


ged at jubileegroup

Aug 15, 2012, 4:05 AM

Post #3 of 3 (461 views)
Permalink
Re: Is there any way for clamscan to only print infected files but also show errors? [In reply to]

Hi there,

On Wed, 15 Aug 2012, David Raynor wrote:

> On Tue, Aug 14, 2012 at 10:25 AM, <Carlo.DiCocco@...> wrote:
>
> > I don't want to list every file clamscan checks (because there are many).
> > When I use the "-i" option to only print infected files, my scan summary
> > results indicate there were errors. However, the errors are not reported
> > because the "-i" option was used. Is there any way to only print infected
> > files but also show errors? I have already tried outputting the stderr
> > buffer to a file, but it's empty.
>
> I noticed that myself when trying to debug some issues earlier this year. I
> added this feature enhancement as bug #5350. With the new design, the "-o"
> command-line option will tell clamscan to suppress OK results, so that both
> infected and error results are printed. That feature will be included in
> version 0.98.

My usual solution to a problem like this is to use 'grep' to suppress any
unwanted output. Something like

clamscan <directory> | grep -v ': OK$'

should do the trick in this case. The enhancement is welcome of course.

The output from stderr is expected to be empty; the notification of
infected files is not an error, but the normal expected result of
scanning an infected file. The output will be on stdout, not stderr.

Incidentally, just lately I've noticed an improvement in the response
from SourceFire on this list. :)

--

73,
Ged.
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml

ClamAV users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.