Delete Quarantined virusmails

Question

Delete Quarantined virusmails

I am sure this question is so basic that I am embarassed to ask it, but here goes.

When I type "sudo ls /var/virusmails" I get a lengthy list of all my quarantined spam and virus messages (spam message files names beginning with "spam-" and virus names beginning with "virus-").

I want to delete the quarantined virus messages, but ...

When I type "sudo rm /var/virusmails/virus*" I get a message that "No such file or directory" exists.

What am I doing wrong?

XServe G5, Mac OS X (10.4.7)

Posted on Aug 9, 2006 8:48 AM

Reply

Answer 1

pterobyte

Level 6

11,104 points

Aug 9, 2006 9:15 AM in response to Joel Mcintosh1

As a general rule of thumb (especially when unexperienced), never try to delete with wildcards by indicating the full path. A typo can wreak havoc.

It's better to cd into the directory where you want to delete files and then use wildcards if needed.

su
cd /var/virusmails
rm virus*

Alex

P.S. You can also edit amavisd.conf and have the infected files deleted rather than quarantined. Search for $QUARANTINEDIR and read explanation.

Reply

Answer 2

Aug 9, 2006 9:39 AM in response to pterobyte

As always, Alex, thank you for your help.

I had read your post about changing the amavisd.cong value for $QUARANTINEDIR to have infected files deleted. I'm still a little nervous about D_DISCARDing, so I was wanting to keep saving and periodically checking the quarantined mail for false positives.

By the way, if I am reading the amavisd.conf file correctly, I think I can set virus mail and spam mails to be handled differently. It looks like I can replace:

$QUARANTINEDIR = '/var/virusmails';

with something like ...

$virus quarantineto = undef;
$spam quarantineto = '/var/spammails';

Is that right? I'm really more interested in looking for false positives among the spam mail. The virus mail isn't of much interest to me.

Reply

Answer 3

pterobyte

Level 6

11,104 points

Aug 9, 2006 9:59 AM in response to Joel Mcintosh1

Joel,

you are correct. Spam and Viruses can be handled differently (not only as far as quarantine). You can also set the quarantine destination to a mailbox rather than a path in your filesystem.

I agree, since your system is relatively new as far as spamassassin training goes you may want to still watch mail for a while. However this also depends on your "kill level" if it is high enough the chances for false positives are virtually inexistent.

Viruses on the other side are pretty much a surefire hit by ClamAV.

Alex

Reply