• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

DrWeb problem "filter fails to pass object"

ErwanG

Regular Pleskian
Hello,

I've problem with DrWeb.
A lot of emails are rejected with this message :

Sender = [email protected]
Recipients = [email protected]
Subject = TR: Audit implant
Message-ID = <009601cdb2e7$3541b2e0$9fc518a0$@[email protected]>

--- Antivirus report ---
Detailed report:
The filter fails to pass object to the DrWEB daemon

--- Antivirus report ---

The original message was stored in archive record named:
file was not created


I've put theses options in /etc/drweb/drweb_handler.conf :
ScanningErrors = pass
ProcessingErrors = pass

The problem seems to be resolved. But the next day, the problem comme back.

An idea ?
 
Usually it is related to timeout settings in /etc/drweb/drweb32.ini and /etc/drweb/drweb_handler.conf
Try to increase FileTimeout and SocketTimeout in /etc/drweb/drweb32.ini at least.
 
I'm also having this problem. I get a "dear postmaster" email that reads: "A message with the following attributes was not delivered because it contains an object which cannot be checked by antivirus."

And the report reads:
--- Antivirus report ---
Detailed report:
The filter fails to pass object to the DrWEB daemon

--- Antivirus report ---

The original message was stored in archive record named:
file was not created

I changed the FileTimeout and SocketTimeout and also set ScanningErrors and ProcessingErrors to "pass". Then restarted DrWeb. After the restart I get an error "Interface binding error (/va/run/.daemon - Address already in use)!
-- bash: syntax error near unexpected token `('
Error listing socket (...

No server changes in the last 72 hours. I'm running Plesk 11.5 on CentOS 6.4

*** problem might have been that Parallels Store could not charge my credit card and instead of notifying me there was a problem it just shut down. Leaving me with the cryptic error message. Can't say for certain at this point as I have uninstalled the Antivirus completely from my server.
 
Last edited:
Back
Top