ClamAV and Anti-Spam

[Kalimari]

benji,
If you have standard QS/SA set-up and quarantine of messages configured, then your messages should go to somewhere like: /var/spool/qscan/quarantine/spam/new

Check the /etc/qmail-scanner.ini SPAMDIR for the precise location.

[benji]

Thanks guys, you've helped me a lot My clients where getting nutts with so much spam :S

I was abt to install psa-spamasassin back again , but for now this will do.

Just one more thing, i have my /etc/qmail-scanner.ini configured like this:

# qmail-scanner settings
QMAILSCANNERHOME="/usr/share/qmail-scanner"
SPOOLDIR="/var/spool/qscan"
SPAMDIR="/var/spool/qscan/quarantine/spam"

But if i do:

Code: Select all

[root@tila quarantine]# pwd
/var/spool/qscan/quarantine
[root@tila quarantine]# du -h
0       ./policy/cur
696K    ./policy/new
0       ./policy/tmp
696K    ./policy
0       ./spam/cur
0       ./spam/new
0       ./spam/tmp
0       ./spam
0       ./viruses/cur
744K    ./viruses/new
0       ./viruses/tmp
744K    ./viruses
1.5M    .
[root@tila quarantine]#

As you see, nothing on directory spam... why? actually it is quarantining stuff is I can see on the log, but... not where is he quarantining the messages

Any clues?

[benji]

I've seen this on log files:

error_condition: X-Qmail-Scanner-2.01st: cannot create /var/spool/qscan/quarantine//var/spool/qscan/quarantine/spam - No such file or directory

what should i put on my config file to make it work? why is he trying to write the file on that strange path? i didnt put that path anywere... ¿?

My qmail-scanner.ini looks like this:

Code: Select all

# qmail-scanner settings
QMAILSCANNERHOME="/usr/share/qmail-scanner"
SPOOLDIR="/var/spool/qscan"
SPAMDIR="/var/spool/qscan/quarantine/spam"
#SPAMDIR="/spam"

[Kalimari]

You need to set the /etc/qmail-scanner.ini SPAMDIR as follows: SPAMDIR="/spam"

Currently set as: SPAMDIR="/var/spool/qscan/quarantine/spam" you have the lines there but commented out the wrong way around

Then run qmail-scanner-reconfigure afterwards.

You have the directories you require by the looks of it: /var/spool/qscan/quarantine/spam/new

[benji]

Yep, now it is quaratining messages, my qmail-scanner.ini

looks like this:

Code: Select all

QMAILSCANNERHOME="/usr/share/qmail-scanner"
SPOOLDIR="/var/spool/qscan"
#SPAMDIR="/var/spool/qscan/quarantine/spam"
SPAMDIR="spam"

Now it is working , finaly! Thanks a lot guys, you rock! =)

[Kalimari]

Good news...

The quarantine will fill very quickly, you may wish to review the messages and move the `hammy` ones to the /tmp dir and run the following:

sa-learn --spam /var/spool/qscan/quarantine/spam/new
sa-learn --ham /var/spool/qscan/quarantine/spam/tmp

Arguably, it is more important to run you ham messages through sa-learn <- Google for more wisdom.

Good luck!

[benji]

Good news...

The quarantine will fill very quickly, you may wish to review the messages and move the `hammy` ones to the /tmp dir and run the following:

sa-learn --spam /var/spool/qscan/quarantine/spam/new
sa-learn --ham /var/spool/qscan/quarantine/spam/tmp

Arguably, it is more important to run you ham messages through sa-learn <- Google for more wisdom.

Good luck!

Thanks a lot!., does SA make any kind of mainteinance of those dirs, does it delete quarantined messages after 1 month or so?

[Kalimari]

It wouldn't take much to add a clean.quarantine to /etc/cron.daily/:

#!/bin/sh
rm -f /var/spool/qscan/quarantine/spam/new/*
rm -f /var/spool/qscan/quarantine/spam/tmp/*

Obviously, you'd need to check the quarantine manually and check for HAM, SA has done its bit YOU need to check the quarantine and use human evaluation. Not sure if the tmp would be cleaned or if this is strictly necessary, others may comment?... And while you're at it, add an sa-update file to /etc/cron.weekly/:

#!/bin/sh
sa-update && service spamassassin restart

or run from command line with:
sa-update -D && service spamassassin restart (-D gives debug output)

You may need to double check paths for your dist.

[breun]

ART's spamassassin package already comes with a daily sa-update cronjob.