Finally solved. The file name appears to be irrelevant, as long as the extension is ign2.

The problem is the rule name: it must be indicated without the .UNOFFICIAL extension (or any other. In some posts I found you need to add .{}).

Hi. I've added Malwarebytes unofficial signature list to my Zimbra ClamAV. It has some over restrictive rules, like MBL_50076603 which blocks all mails containing a link to Google Drive. So I want to whitelist some of them, like this. The zimbra email notification looks like this: A virus was found:...

To add IP address or networks in CIDR format zimbra@zimbra:~$ zmprov mcf zimbraHttpThrottleSafeIPs 223.232.129.201 zimbra@zimbra:~$ zmprov mcf zimbraHttpThrottleSafeIPs 201.58.38.113 zimbra@zimbra:~$ zmprov mcf zimbraHttpThrottleSafeIPs 172.33.5.0/24 This is not correct: IPs must be added with + (a...

I think there's no logging for normal operations, only for errors

How strange. Unfortunately I don't know python so I cannot help further. You can try opening an issue on the project's github

zimico wrote:Just remove the .sock file (the path is in the conf file) and restart service. And then you will see the errors which relate to .py files.

I have no idea how the plugin works, but based on this message Connection to www.virustotal.com timed out. it looks like your server cannot reach VT

From this line Nov 12 15:06:20 mail.zoholab.com amavisvtd[16553]: 2019-11-12 15:06:20,394 ERROR [MainThread] Socket /opt/zimbra/data/clamav/amavisvtd.sock isn't working: [Errno 111] Connection refused it looks like either the socket isn't created or it doesn't have permissions to access the location.

I was mistaken. Content of /etc/systemd/system/amavis-vtd.service is [Unit] Description=AmavisVTd [Service] ExecStart=/usr/bin/python3 /usr/local/lib/python3.5/dist-packages/amavisvt-0.5.3-py3.5.egg/amavisvt/amavisvtd.py Restart=always RestartSec=10 StandardOutput=syslog StandardError=syslog SyslogI...

The service file is in the GitHib repo of the project. I'll try to document better

It's an old page (2016) and it's in french (sorry) but here you have informations about using the free version of Tyk as proxy/cache to the VT API. https://blog.zenithar.org/post/2016/01/15/tyk-proxy-virustotal/ Thanks, very useful. It needs a little tweaking, at least for how I intended to use it....