Virus blocker Lite Logfiles

[thafener]

Hi @all

Have a issue with Virus Blocker Lite, in the overview in the Rack it says that it has in fact scanned mails but if I
want to check this in reports I see that there is no data.

In reports I get the mesage that Virus Blocker Lite has scanned 0 email messages of which 0 were blocked.

How come ? And where can I find the corrsponding log file ?

I am running Build: 12.0.0~svn20160409r42916release12.0-1jessie

Kind regards

thafener

[jcoffin]

The reports by default show only the current day's events. The rack counter shows all events since the last reboot.

[dmorris]

Reports > Virus Blocker Lite

[thafener]

Hi jcoffin

Thank you, understood it the same way. But I have VB Lite up for weeks and the reports are empty, according
to the desing it show something from the previous days ?
Just want to make sure this app is working properly, so where can I find the logfile ?

Kind regards

thafener

[dmorris]

Reports > Virus Blocker Lite.

[thafener]

Thank you dmorris,

found the logs and events. I have sent several mails with attachments this morning and could not see any log or event
entries thereafter.
These were .docx and .xlsx attachments, of course VB Lite was configured to scan them.

So I should find entries in Reports - VB Lite - E-Mail Usage (scanned) ?

Kind regards

thafener

[jcoffin]

How are you receiving the emails, pop, imap, smtp? If smtp, is it unencrypted on port 25?

[thafener]

We're receiving mails via smtp and unencrypted using a server of our provider as a smart host. Our mail server is Zentyal with Zarafa.
So our mail server is using the standard gateway which is our Untangle FW and so all traffic should be scanned right ?
Had another test today with the Eicar test virus, uploaded it via FTP and VB Lite said it was blocked but the file was uploaded to
the ftp server.

[dmorris]

Did you check the md5 on the file?
FTP works by trickling the file so there will be a partial file even when its blocked.

If you see no email events in the reports, then it is not scanning anything.
You can look at the sessions of the app, or the sessions in config to see if there is a port 25 session going through virus blocker.

[thafener]

Well I can see a session on Port 25 but what I do not understand is that the logs are empty. There should be entries as we are getting
a lot of mails with attachments every day.