User manual KASPERSKY ANTI-VIRUS FOR SENDMAIL WITH MILTER API

[. . . ] KASPERSKY LAB Kaspersky Anti-Virus® 5. 6 for Sendmail with Milter API ADMINISTRATOR'S MANUAL KASPERSKY ANTI-VIRUS® 5. 6 FOR SENDMAIL WITH MILTER API Administrator's manual © Kaspersky Lab http://www. kaspersky. com Revision date: March 2006 Contents CHAPTER 1. KASPERSKY ANTI-VIRUS® FOR SENDMAIL WITH MILTER API. . . . . . . What’s new in version 5. 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hardware and software system requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Notification macros for the application Macros can be used in notification templates for either entire messages or their parts. Using macros, you can customize notifications to include additional information on the properties of an original message or object or about actions applied to them. The administrator can use the following macro in notifications concerning entire messages: %CLIENT_ADDR% – remote address of the mail client. %BK_ACTION% – actions applied to the message that caused a backup copy to be created (if the application is configured to back up messages). %BK_LOCATION% – full path to the backup storage (if the storage exists). %ACTION_LIST% – list containing information about the message and its object and a list of actions applied to them. The information is output in the following format: <status> <action> <information> for each processed part of the message. In notifications related to deleted objects from a message, the following macro can be used: %STATUS% – object status assigned as the result of scanning or filtering. 68 Kaspersky Anti-Virus® for Sendmail with Milter API %ACTION% – action applied to the object based on its status. %INFO% – information related to the following actions performed: • • • list of detected viruses (malicious software) – for infected objects; error code description – for objects that generated a scan error; MIME type or attachment name – for filtered objects. The macros must be specified in the text of notification templates. 7. 11. Reporting options Kaspersky Anti-Virus performance results are logged in the application report. You can store results either in the system log or a separate file (defined by the LogFacility parameter of the [kavmilter. log] section in the kavmilter. conf configuration file). The report contains records about: Events related to application functionality – all events that occur during application performance, for example, results of message scans. Events not related to the application functionality – all events that are not directly caused by application performance but provide important information. This information can be the size of the backup storage, application errors, license policy events, etc. The administrator can decide what information will be included into the report and determine the detail level of the selected data for each. The types of data and their detail levels are discussed below. The following information can be logged in the report: • • • • • • • config – records about the application configuration; scan – information about scan results and actions performed; backup – data related to backing up e-mail messages; app – system messages about application initialization, signals, and processes; notification – messages regarding dispatch of notifications; all – all the above types of data. Each of these categories can be assigned a special detail level: critical – critical events that interrupt application operation; Additional setup 69 • • error – errors that can be fatal or non-fatal for application operation; warning – events that reflect unusual situations during application performance; it is useful for the administrator to be aware of such situations; notice – events related to the application business logics; info – general information concerning the application functionality; debug – debugging messages; all – all the above levels. • • • • You can combine the information categories and their detail levels. For example, if you want to record all information related to backing up messages, enter the following parameter value into the [kavmilter. log] section in kavmilter. conf configuration file: LogOption=backup. all To log only configuration errors, type the following: LogOption=config. error To prevent some information from logging, type, for example, the following: LogOption=-scan. debug The minus before a combination means that this category will be excluded from logging. The remaining information will be logged. You can also use three alternative forms for specifying detail level (see table 2 ). Table 2. Alternative recording forms Symbolic debug activity Info warning Error Fatal Literal D A I W E F Numerical 9 4 3 2 1 0 70 Kaspersky Anti-Virus® for Sendmail with Milter API The following values, for example, can be used: LogOption LogOption LogOption LogOption = = = = backup. W config. E scan. 0 -scan. 9 Because the log file size grows rapidly, it is recommended to use log file rotation option to avoid creation of long log files which are hard to analyze (LogRotate=on). In this mode, when the report file grows and reaches RotateSize, it is copied to kavmilter. <number>. log and the initial log truncates to zero. [. . . ] It shall be at the absolute discretion of Kaspersky Lab whether or not you have satisfied this condition for the provision of Support Services. (ii) Support Services will terminate unless renewed annually by payment of the then-current annual support charge and by successful completion of the Support Services Subscription Form again. (iii) By completion of the Support Services Subscription Form you consent to the terms of the Kaspersky Lab Privacy Policy, which is deposited on ww. kaspersky. com/privacy, and you explicitly consent to the transfer of data to other countries outside your own as set out in the Privacy Policy. (iv) "Support Services" means: (a) Daily updates of the anti-virus database; (b) Free software updates, including version upgrades; (c) Extended technical support via e-mail and phone hotline provided by Vendor and/or Reseller; (d) Virus detection and disinfection updates 24 hours per day. [. . . ]