7.3R4 Host Checker on Mac...

[rswinter_]

Hi All, I was wondering if anyone lese is seeing this....

We have host checker setup to check for a specific Virus Dat file (ClamXav in this case) with the following rule:

<%user.home%>/Library/ClamXav/db/daily.cld 

File modified less than 14 days ago.

For some reason since we've updated to 7.3, this no longer works.  I have the exact same rules setup on our 7.3r4 (Mag 4610), 7.3r1 (SA2500) and 7.1r12 (SA4000) servers and it only works on the 7.1r12 server...

In the Host checker failure message out to clients, it even says "Users/myusername/Library/ClamXav/db/daily.cld not found.", but I can go to the directory and see the file it right there and with todays date...

If I have one of the pre-defined AV applications on the Mac, it finds those just fine, so Host Checker appears to be getting loaded properly.

Suggestions?     I'm going to open a ticket with support, but figured I'd check here first and see if anyone else has seen this...

-Stephen

[zanyterp_]

Please try <% HOME %> instead.

do you have an option to test 7.3R6?

[rswinter_]

I have not had the chance to open a ticket yet... I will do so when I have time.

I saw that ClamXav is not in the list, but it never has been (AFAIK) for Macs... We have always used a Process and File check for it...

I tried <% HOME %> and it didn't recognize the HOME with spaces and used that literal string as the check..  when I use <%HOME%> in the file check, the failed message does spit out my full path and username correctly, but still fails

We will be upgrading the SA2500 to 7.3r6 in the near future, so we'll give that a test...

We have very few mac users, so for the short term, I'm going to suggest they use a differnt AV app..

Thanks...

[rswinter_]

This is through the browser/Safari.

[Kita_]

Is host checker being utilized through the browser or through Junos Pulse?

[Kita_]

I have not heard of any issues with checking a file path, but I have heard of issues with Clam AV no longer passing HC after 7.2 release.  There were some changes performed by OPSWAT after Juniper 7.2 release which caused issues with the Clam AV product no longer being detected properly.  Can you please provide your support case #?  I would like to review the logs to see if this is the same issue or not.

[PaddleFace_]

OPSWAT maintains a list of supported Mac AVs at http://www.opswat.com/products/oesis-framework/supported-applications#!product=firewall&os=mac

Presence on the list does not necessarily mean that all APIs OPSWAT exposes for antivirus applications generally are implemented for each of the listed AV.