[resending to list for completeness]
Hello Andrew,
Thanks for the suggested solution. Unfortunately I'm not familiar with
Lua (yet).
Actually I've found a quite simple solution after I gave it a second
thought today. Don't know why I haven't thought of it before.
# rspamd.conf.local:
antivirus {
clamav {
symbol = "CLAM_VIRUS";
patterns {
JUST_EICAR = "^Eicar-Test-Signature$";
}
}
}
# local.d/metrics.conf:
symbol "JUST_EICAR" {
score = 7.0;
description = "Eicar-Test-Signature";
}
symbol "CLAM_VIRUS" {
score = 100.0;
description = "Possibly malware detected by ClamAV signatures";
}
The default action for ClamAV is now unset but a default symbol is
assigned if no patterns are matched. The default symbol sets a high
score to make sure the message gets rejected.
--
Alex JOST