[squid-users] icap SOPHOS SAVDI and custom errorpage

Amos Jeffries squid3 at treenet.co.nz
Fri Jan 10 05:30:57 UTC 2020

On 9/01/20 10:22 pm, netadmin wrote:
> I try to use the configuration given in the previous post

FYI: this post started a brand new thread, there is no previous post
visible to us. Please provide a direct reference to the post and/or
config file in question.

> with: Squid 4.9 and
> Sophos SAVDI 2.6.
> If I download a virus file, the Squid sends the file for scanning and is
> detected by Sophos SAVDI (I find it in logs) but it is not blocked by Squid
> (I can download it).
> The problem I think is in the response received by the Squid after the scan
> but I do not know where.
> Has anyone managed to make this solution functional?

I assume the config uses the AV software as an ICAP service?
That has been made working by many AFAIK, with several different AV

It is most likely that the ICAP service is either telling Squid it can
start delivering the response early before it finds the virus payload.
Or, producing the wrong response and thus causing Squid to deliver the

To help we are likely to need your squid.conf details, the access.log
entries that show the transaction(s) you know are wrong, and the
icap.log content.


More information about the squid-users mailing list