My setup uses clamd + amavisd + spamassassin + postfix to filter email. It's done a great job for years. I use maia mailguard as an interface to manage verifying ham/spam.
Up until the last month or so the ratio of ham/spam/virus-infected email identified by this framework was roughly 3 hams to 20 suspected spams to 30 virus-infected emails. Recently, that's shifted to more like 3 hams to 45 suspected spams to 5 virus-infected emails. I'm wondering if this reflects a change in the way clamav operates, or (more likely) something that needs to be adjusted in my setup. I recall checking out, years ago, some of the "virus infected" emails and noticing that it seemed like clamav was identifying stuff that came from sources it couldn't validate as virus-infected. Which was fine by me, as it saved me the trouble of reviewing them as potential spam before reporting them. I thought this might mean I was no longer getting access to some of the blacklists, but I didn't see messages to that effect in my system logs. To be clear, things are still working fine in terms of blocking spam. It's just that now there's a lot more stuff to review before reporting. I'm just curious as to whether or not something new is going on behind the scenes. - Mark "Too much sanity may be madness! But maddest of all -- to see life as it is and not as it should be." _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
