On Fri, 19 Sep 2008, Vincenti Francesco wrote:
> Good morning everybody,
>
> My name is Francesco, from ThyssenKrupp.
>
> I'm mailing you for some suggestions about a problem which I find in my
> antispam system, based on spamassassin.
>
[snip..]
> - Each node has 4GB RAM and two processors
>
> - O.S. Fedora core 3
>
> - Mail server qmail 1.0.3
>
> - Antivirus clamav 0.87.1
>
> - Antispam spamassassin 3.0.4
>
> - Cluster controller heartbeat
>
> - Interface qmail-scanner-queue.pl
>
> Starting from the 15th of July, I find, sometimes, in the log file of
> qmail-scanner-queue.pl the following alert instead of normal score: SA:
> finished scan in 600.010015 secs - hits=?/?.
[snip..]
>
> I have to write and to upgrade a local configuration file, named
> local_rules.cf which has reached the dimension of 250KB it is very
> useful to stop a lot of SPAM which is not stopped by the other rules.
> The problem started to appear after one of the upgrade I usually have to
> do, which wasn't so dramatic to justify this behaviour, I think.
Two things;
1) That is an obsolete version of clamav (current version is up to 0.94)
The database updates probably are not working with your client as
the database contains features that are version specific.
So you may not be protected at all due to database VS client version
mismatches.
Update it promptly.
2) That is an obsolete version of spamassassin, (v3.2.5 is current, v3.3
almost out.) Spam is a constantly thing thing as spammers try to
circumvent anti-spam measures, so spamassassin evolves to try to beat it.
This you have already found by your need for that very large local config
file. If you update to a more recent version of spamassassin you can
probably get rid of that oversized local config file and get better
performance than you have already.
Bottom line, update both ClamAV & spamassassin.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
