Sophos SPL AVScanner exit codes

Question

Where can I find documentation on the exit codes used by the avscanner component of Sophos SPL? I want to run the scanner as part of a build pipeline and fail it if there is a detection. I have only been able to run it on clean files and I can see it returns 0 (as expected) but what does it return when it detects something? 
 Any idea where I can find this information?

DouglasLeeder · Accepted Answer

You can use eicar to test avscanner detecting a threat: 
 https://docs.sophos.com/central/customer/help/en-us/PeopleAndDevices/ProtectDevices/ServerProtection/SophosProtectionLinux/ServerProtectionAgentTestDetectionFeatures/index.html 
 Exit codes are listed on: 
 https://docs.sophos.com/central/customer/help/en-us/PeopleAndDevices/ProtectDevices/ServerProtection/SophosProtectionLinux/ServerProtectionAgent/index.html#on-demand-scan-return-codes 
 
 In particular 24 is the exit code when a threat is found, but any non-zero exit code means something went wrong, so the file may not have been scanned and found clean.

Sophos SPL AVScanner exit codes

Top Replies