Thanks for the reply Jimmy. After playing some more - with priorities in clamav.cf, I got it working, and was just about to explain a fix, when I noticed Henrik has updated the ClamAVMultipleScores page to have a similar (actually better!) fix that I was going to suggest!
# Run CLAMAV early so all the rules here will see the results priority CLAMAV -10 and removal of all the individual priorities Thanks Henrik! Andrew. On Fri, 3 Nov 2023 at 02:15, Jimmy <[email protected]> wrote: > > The X-Spam-Virus could be absent from the email header. > > You can consider adding the following line: > > add_header spam Virus _VIRUSRESULT_ > > If this doesn't work, the ClamAV plugin might need to include > "put_metadata('X-Spam-Virus')" when it detects a virus. > > Jimmy > > > On Fri, Nov 3, 2023 at 4:06 AM Andrew Hearn <[email protected]> wrote: > >> Hello, >> >> We're using clam, some extra signatures, and the plugin/config as >> described on >> https://cwiki.apache.org/confluence/display/SPAMASSASSIN/ClamAVMultipleScores >> to give different signature families different scores. >> >> Since moving to v4, I don't think it's working... >> >> The only rule that is matched now, is the generic CLAMAV_VIRUS rule. >> The rules for the various other signatures are no longer matched. >> Could this be due to the change in priorities for meta rules, and now >> these meta rules are running before they get to see the results from clam? >> >> I can send my config examples and debug output if that's helpful. >> >> Thanks! >> >
