Re: SpamProbe + ClamAV

--===============1366752374==
Content-Type: multipart/signed;
	boundary="PGP_Universal_5982402A_4A4A382B_E85972EA_B3E35BD4";
	protocol="application/pgp-signature"; micalg="pgp-sha1"


--PGP_Universal_5982402A_4A4A382B_E85972EA_B3E35BD4
Content-type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: QUOTED-PRINTABLE

On 1/28/07 4:33 AM, "Nikolaus Hiebaum" <[email protected]> wrote:
> A while ago, I asked a question here regarding an obscure ClamAV error th=
at
> happens in combination with SpamProbe. Well, nobody replied; hence, I'll =
try
> again ...

Probably because people didn't consider it to be a SpamProbe question.


> I am running SpamProbe 1.4d and ClamAV 0.88.7 on my system (a shared
> FreeBSD server). Both SpamProbe and ClamAV are invoked through a .procmai=
lrc
> rule. In general, my .procmailrc-setup looks like this:
>=20
> 1) Run everything through ClamAV (via Clamassassin)
> 2) Check if mails are for mailing lists and shuffle them in the respective
> folder
> 3) Run SpamProbe
> 4) Do more mail shuffling
>=20
> Every now and then it happens that e-mails get "destroyed" and there is an
> obscure error in the mail header: Clamscan error 137.

I have been running clamscan followed by SpamProbe for years now and have
never encountered this issue.  I have not used clamassassin so I have no
idea what that really does, I simply run clamscan directly to set a header
and reroute virus mails then run spamprobe on anything not identified as a
virus.

If you are seeing emails destroyed then you should use a rule in your
procmailrc to save a backup of every email for a while then when one gets
destroyed look for the original in your backup folder.  That way you might
be able to see something interesting about that email and test that email
directly by running clamscan (or whatever) on it by hand.

> So, my question is if anyone of you has an idea what could be the cause o=
f the
> problem. Also, what would you suggest in terms of order and processing
> efficiency of ClamAV & SpamProbe.

No ideas.  As I said above I have always run clamscan first and then
spamprobe.  I do train on the virus mails by having cron run a spamprobe
train-spam of the virus folder.

All the best,
++Brian



--PGP_Universal_5982402A_4A4A382B_E85972EA_B3E35BD4
Content-Type: application/pgp-signature;
	x-mac-type=70674453;
	name=PGP.sig
Content-Disposition: attachment; filename=PGP.sig

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.5.2 (Build 4075)

qANQR1DEDQMBCAE8UchKCX1yBQHCwFUDBQFFvLm4PFHISgl9cgUBCEftCACrESM/
8iLkhh1KRjb8dY5L+LZa1mKNR34DUhH91Af5GZ09xHk2ufkRapFADeEu+TvhE6Vs
elrZZlBHQx/tGFY4+jly8lCFfcgiXp6w04pv9tOuYc8BdbG3a+qMBPhubPjoz5xG
qm6+0Z/2FfeHM0u/bqQTP7bAki/b86deSm9gvaDJ2VPMAInDomRwKx9Awr9v8F/d
C0m/bBa3VPbHpyrL37RUmo3fwcAuHpUU9tR/q7KpKGDcbxb/Ii++jF5bkAh+c5fR
HFtJHZUS+GOWjKva5TSvMiE+CzbCNSrDUQAmaHKXr3SyuI4A1goMrYI87O4F7VXT
p8m+M6cYMc9iOMzm
=swMp
-----END PGP SIGNATURE-----

--PGP_Universal_5982402A_4A4A382B_E85972EA_B3E35BD4--


--===============1366752374==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
--===============1366752374==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Spamprobe-users mailing list
Spamprobe-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/spamprobe-users

--===============1366752374==--