[Sophos anti-virus for Linux] Can I add excluded files or directories recursively by "**"?

Kyle Parrish Thank you for your response!

I tried end of the path "*", but I can't tell this works.

I'd like to build some software, so I add the root directory like "/work/poky/*",

builder read and generate files in the directory.

Top command shows savscand's CPU usage is high (over 100%) during building software.

So I guessed ExcludeFileOnGlob doesn't works recursively, is this right?

Hmm. I have not tried this, but how about you use lsof to monitor that directory while a scan is taking place to see if any files are accessed? The command might look something like this:

lsof +D -r 1 '/work/poky/'

lsof = list open files

+D = recursive

-r = repeat ever 1 second

Thank you for advising me!

But lsof command doesn't show savscand open the /work/poky/*...

So I couldn’t know what files savscand  opened.

Is there another way to confirm if recursive exclusion is enabled?

BTW, I didn't know the command, but it's very useful!

I'd like to use this on another chance;)

I confirmed it!

I used eicar to confirm if recursive exclusion was enabled.

result: ENABLED!

add ExcludeFileOnGlob '/work/poky/*'

then put eicar at /work/poky/build,

It was not detected(of course, at the directory out of the /work/poky , eicar was detected).

Thank you for spending time for me!

I close this as resolved.

Awesome! Good idea using EICAR!

Awesome! Good idea using EICAR!