Topic: [Announce]: ClamAV updated to 0.91.2 and SpamAssassin to 3.1.9

[Knuddi]

You might all have noticed that I have released two now packages. Clam Antiivirus has been updated to 0.90.2 and Spamassassin to 3.1.9

I can see that ~2000 servers have picked up Spamassassin and ~750 Clam after 24 hours of availability.

Enjoy,
Jesper

[Brenno]

Knuddi,

For some reason, I'm not picking up the update:  Per the USA.log:

Aug 28 09:44 USA :  SpamAssassin is up to date.
Aug 29 09:44 USA :  SpamAssassin is up to date.
Aug 30 09:44 USA :  SpamAssassin is up to date.

rpm -q | grep spamassasin shows:

spamassassin-3.1.5-1
spamassassin-tools-3.1.3-1

I checked that "Download updates and warn admin" is set in the SpamFilter panel.  I was hoping the upgrade would solve the issue of increased false-negatives lately (spamassassin seems to be intermittently scanning outside emails as determined by monitoring the message headers.)


Any thoughts?

[Knuddi]

You properly haven't updated the update paths in the database as was explained a while ago

# export PRIMARY=http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/swerts-knudsen/SpamFilter
# export SECONDARY=http://ftp.nluug.nl/os/Linux/distr/smeserver/contribs/swerts-knudsen/SpamFilter

#/sbin/e-smith/db swerts-knudsen setprop USAprimary url $PRIMARY
#/sbin/e-smith/db swerts-knudsen setprop USAprimary name ibiblio.org
#/sbin/e-smith/db swerts-knudsen setprop USAsecondary url $SECONDARY
#/sbin/e-smith/db swerts-knudsen setprop USAsecondary name nluug.nl

Then try to force the USA script to run and see whether you get some new stuff down

# USA

[Brenno]

Knuddi,

Nothing seems to have happened?  Here's the putty log:

Code: [Select]

[root@mail root]# export PRIMARY=http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/swerts-knudsen/SpamFilter
[root@mail root]# export SECONDARY=http://ftp.nluug.nl/os/Linux/distr/smeserver/contribs/swerts-knudsen/SpamFilter
[root@mail root]# /sbin/e-smith/db swerts-knudsen setprop USAprimary url $PRIMARY
[root@mail root]# /sbin/e-smith/db swerts-knudsen setprop USAprimary name ibibio.org
[root@mail root]# /sbin/e-smith/db swerts-knudsen setprop USAsecondary url $SECONDARY
[root@mail root]# /sbin/e-smith/db swerts-knudsen setprop USAsecondary name nluug.nl
[root@mail root]# USA
[root@mail root]#
Is there a file / location / log where I can verify that something did / did not happen?

USA.log shows:

Code: [Select]

Aug 30 11:42 USA :  SpamAssassin is up to date.
Aug 30 11:45 USA :  SpamAssassin is up to date.

[Knuddi]

Arghh - I made a mistake...

The four db commands should set the "altiplano" entry in stead of swerts-knudsen..

ex.
[root@mail root]# /sbin/e-smith/db altiplano setprop USAprimary url $PRIMARY

[Brenno]

OK... tried that:

Code: [Select]

[root@mail root]# export PRIMARY=http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/swerts-knudsen/SpamFilter
[root@mail root]# export SECONDARY=http://ftp.nluug.nl/os/Linux/distr/smeserver/contribs/swerts-knudsen/SpamFilter
[root@mail root]# /sbin/e-smith/db altiplano setprop USAprimary url $PRIMARY
[root@mail root]# /sbin/e-smith/db altiplano setprop USAprimary name ibibio.org
[root@mail root]# /sbin/e-smith/db altiplano setprop USAsecondary url $SECONDARY
[root@mail root]# /sbin/e-smith/db altiplano setprop USAsecondary name nluug.nl
[root@mail root]# USA
[root@mail root]#
USA.log still reports that Spamassassin is up to date:

Code: [Select]

Aug 30 11:54 USA :  SpamAssassin is up to date.
/home/e-smith/altiplano shows as updated at 11:53:56 2007, so I believe that worked.

[Knuddi]

Are you using e-smith-USA-0.4.6-1.noarch.rpm?

# rpm -qa | grep USA

If not then install from:

# rpm -Uvh http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/swerts-knudsen/SpamFilter/e-smith-USA-0.4.6-1.noarch.rpm

[Brenno]

Knuddi,

This appears to have done the trick:

Code: [Select]

[root@mail root]# rpm -qa | grep USA
e-smith-USA-0.4.4-1
[root@mail root]# rpm -Uvh http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/swerts-knudsen/SpamFilter/e-smith-USA-0.4.6-1.noarch.rpm
Retrieving http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/swerts-knudsen/SpamFilter/e-smith-USA-0.4.6-1.noarch.rpm
Preparing...                ########################################### [100%]
   1:e-smith-USA            ########################################### [100%]
Stopping crond: [   OK   ]
Starting crond: [   OK   ]
I then received the email notifying me that there were updates ready to install and followed the instructions:

Code: [Select]

[root@mail root]# rpm -e spamassassin-tools-3.1.3-1
[root@mail root]# rpm -Uvh /tmp/USA/*.rpm
Preparing...                ########################################### [100%]
   1:perl-Mail-SpamAssassin ########################################### [ 50%]
   2:spamassassin           ########################################### [100%]
Stopping spamd: [   OK   ]
Starting spamd: [   OK   ]
[root@mail root]#
I'll monitor to see if this improves the false-negative performance I've been having.

Thanks for all the help!

[Brenno]

Knuddi,

I've been monitoring SA since I upgraded (thanks to your help) and while I am seeing a very sharp increase in the quantity of spam that my system is catching, I'm still seeing spam breaking through.  By checking the headers on the false-negatives, I can see that they aren't being scanned by SA at all.  I have noted that SA does not scan internal email on my primary domain at all, but it should be scanning all external and/or non-local domains, correct?

Currently, I'm blocking an average of 89.6% of inbound email based on my RBL config, so the performance is actually quite good.  I'm just curious if anybody else is seeing SA missing some emails altogether.