Re: amavis vs sophie vs sophos

Glenn,

>   Apr  8 16:28:39 csespare3.ucsd.edu /usr/sbin/amavisd[14396]: (14396-01)
>   ask_av (Sophie) result: -1:Error: The main body of virus data is out of
>   date.

Don't know what is happening between your Sophie and libsavi.

> The worst part about this is that the mail never gets sent out of
> amavis.  The debug messages show it to be "preserving evidence
> in /blah/blah", but the mail is essentially dropped.  Seems unsafe.

The mail is not dropped, it should still be in the mailer's queue,
to be retried every now and then by Postfix.

To avoid the problem, you should add some other virus scanner
to the mix. It is customary to provide the 'sweep' as a backup scanner,
which will only be consulted if Sophie fails. This would also prevent
amavisd-new tempfailing the messages and preserving evidence.

> My question is, is that really the case?  The failure mode for this
> setup when sophos expires (as it does every three months I understand)
> is for mail to disappear?

No, mail should not be disappearing. If the problem with libsavi is not 
resolved in a couple of days, Postfix will start sending non-delivery 
notifications for expired mail in the queue.

It is also customary to use clamd along with Sophie in the list of scanners.
Both are quite quick, and back up each other, just in case.

  Mark