User manual KASPERSKY LAB ANTI-VIRUS 5.6 FOR LINUX MAIL SERVER ADMINISTRATOR GUIDE

[. . . ] KASPERSKY LAB Kaspersky Anti-Virus 5. 6 for Linux Mail Server ADMINISTRATOR'S GUIDE KASPERSKY ANTI-VIRUS 5. 6 FOR LINUX MAIL SERVER Administrator's Guide Kaspersky Lab http://www. kaspersky. com Revision date: November, 2008 Contents CHAPTER 1. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Whats new . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Product requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] For example, the component is infected, or an error occurred during verification, or loading of the database or the keys. Critical errors information is marked with , , F symbol in the log file. Information about other errors including those that cause the component to close: for example, object scan error information. Information about errors that may cause the application to close: for example, information about insufficient free disk space or key expiration. Important informational messages: for example, information stating whether the component is running, the path to the configuration file, scan scope, information about the anti-virus database, about keys, and statistical info about the results. Messages about current application activity (for example, the name of the object being scanned). Such messages are marked with , , A symbol in the log file. Level symbol 0, F 1, E error 2, W warning 3, I info 4, A activity Reporting and statistics 87 Level symbol 9, D Level name debug Description Debug messages. Such messages are marked with , , D symbol in the log file. Logging options can be specified in the following manners: a combination of group and level (for instance, scan. info); level-group combination, prefixed with '-' will determine the exclusion of the specified option. Example: [kav4lms:server. log] Options = backup. all, config. error, scan. all, -scan. debug Options = backup. all, config. E, scan. all, -scan. 9 This will enable all backup messages, all error messages from config and all scan messages, except debug. The second example is identical to the first one and shows usage of level selection options. In order to select several levels, all these levels must be listed or non-desired levels must be excluded. Log files can grow very quickly, but their size can be limited by enabling the logs rotation. This feature is enabled by setting the RotateSize and RotateRounds parameters to non-zero values. If logs rotation is enabled, then the log file grows until its size reaches RotateSize. If file with this suffix already exists, then files with suffixes , , . 2, , , . 3, etc. When this value is reached, file with , , . 1 suffix will be used again. 9. 2. Application statistics Note: The options of application statistics collection are located [kav4lms:server. statistics] section of the main configuration file. in the 88 Kaspersky Anti-Virus 5. 6 for Linux Mail Server While the application is running, statistics of two types is collected: General statistics gathered from time to time and reflecting overall application activity. Detailed statistics gathered on each processed message. The type of statistics stored is specified via the Options parameter. Statistics category Messages Options value messages Information stored Number of incoming messages, number of scanned messages, number of protected messages, number of infected messages, number of erroneous (corrupted) messages, average of all message sizes (in bytes), average time spent on checking one message (in milliseconds) The time in seconds since last request for statistics was made, total traffic size (in kilobytes), total CPU usage by user, total CPU usage by system Latest 10 viruses detected, first 10 IP addresses that sent most viruses Number of MIME-filtered messages, number of messages filtered by attachment, number of messages filtered by size, number of messages filtered by virus name All above mentioned Comprehensive per message statistics No statistics are gathered System resources resources Detected threats Content filtering viruses filters All Per message statistics No statistics all raw none The Options parameters value is the list of the mentioned values, delimited by commas. Reporting and statistics 89 Examples: Options = all Will collect only the aggregate ones (messages, resources, viruses, filters) Options = all, raw Will also collect per message statistics. Options = none, raw Will collect only per-message data, no aggregates. In order to enable statistics collecting, set the Options parameter to value, other than none. Sample record from the raw statistics file: 1210247100 1208 from@exmaple. com rcpt@example. com infected EICAR-Test-File 127. 0. 0. 1 1Ju4YW-000Du9-0U Default where: 1210247100 ­ time when a message was processed (in UNIX format); 1208 ­ message size; from@example. com ­ message senders address; rcpt@example. com ­ message recipients address; infected ­ status assigned to message after scanning; EICAR-Test-File ­ name of the threat detected in message; 127. 0. 0. 1 ­ IP address used to send the message; 1Ju4YW-000Du9-0U ­ message ID in mail system queue; Default ­ name of the group associated with the settings used to process the message. To write statistics to a file run the following command: # /opt/kaspersky/kav4lms/bin/kav4lms-cmd -m statistics -x \ write This command also rewrites the existing statistics file with new information. 90 Kaspersky Anti-Virus 5. 6 for Linux Mail Server To reset internal statistics counters run the following command: # /opt/kaspersky/kav4lms/bin/kav4lms-cmd -m statistics -x \ reset Note: The statistics file must be rewritten to reflect changes after the counters have been reset. [. . . ] This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. [. . . ]