You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Art Greenberg <ar...@eclipse.net> on 2010/01/05 14:45:30 UTC
ClamAV Plugin Question
I saw this plugin listed in the SA Wiki, and contacted the author listed
in the Wiki about this issue. Seems he's disowned the thing, and he
suggested asking here. Is anyone on the list using this plugin?
I just installed the ClamAV plugin for SpamAssassin. This is a fresh
install of SpamAssassin-3.3.0-rc1 and ClamAV-0.95.3 with Postfix on CentOS
5.4. I'm using procmail via .forward to interface with SA. This server is
a home server with just a few email accounts being handled on it.
SA and ClamAV both seem to be scanning email and otherwise working
properly, except that the ClamAV plugin is inserting the X-Spam-Virus
header twice. Messages with a virus found are showing it first with "No"
and the second time with "Yes". In messages where no virus is detected, it
is "No" both times. The second instance immediately follows the first. The
report inserted into the header by SA only shows the ClamAV result once
and only when a virus is detected, and it looks like SA properly scores
it.
This is obviously not a serious problem, but it does seem odd. Is it
possible that messages are being processed by ClamAV twice, the result
being the double header insertion? And perhaps the first pass through does
not detect a virus?
I had a previous installation of SA 3.2.5 with ClamAV 0.95-3 and Postfix
that used clamsmtpd to hook ClamAV into Postfix. That setup did not
display this behavior.
--
Art Greenberg
artg@eclipse.net
Re: ClamAV Plugin Question
Posted by Art Greenberg <ar...@eclipse.net>.
On Thu, 7 Jan 2010, Mark Martinec wrote:
> Please try the new plugin code at:
> http://wiki.apache.org/spamassassin/ClamAVPlugin
>
> not forgetting to add a:
> add_header all Virus _CLAMAVRESULT_
> into your local.cf.
>
> See also https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6254
>
> Mark
Thanks Mark. I've installed the updated plugin and, at least on mail
having no virus detected, the issue is gone.
I'll have to wait for an "infected" email to be certain, but I think this
change fixed the bug. You'll only hear from me on this matter again if
that turns out to not be the case.
--
Art Greenberg
artg@eclipse.net
Re: ClamAV Plugin Question
Posted by Mark Martinec <Ma...@ijs.si>.
On Tuesday January 5 2010 15:15:58 Art Greenberg wrote:
> > On Tuesday January 5 2010 14:45:30 Art Greenberg wrote:
> >> SA and ClamAV both seem to be scanning email and otherwise working
> >> properly, except that the ClamAV plugin is inserting the X-Spam-Virus
> >> header twice. Messages with a virus found are showing it first with "No"
> >> and the second time with "Yes". In messages where no virus is detected,
> >> it is "No" both times. The second instance immediately follows the
> >> first.
>
> On Tue, 5 Jan 2010, Mark Martinec wrote:
> > The issue is already tracked as:
> > https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6254
> > Will look into it...
>
> Thanks for pointing me to that bug report, Mark. I just verified that the
> plugin (clamav.pm) I am using has the fix discussed there.
>
> What I am seeing differs from what Larry reported in Comment 7, in that I
> am seeing the X-Spam-Virus header inserted twice even when ClamAV does not
> detect a virus.
Please try the new plugin code at:
http://wiki.apache.org/spamassassin/ClamAVPlugin
not forgetting to add a:
add_header all Virus _CLAMAVRESULT_
into your local.cf.
See also https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6254
Mark
Re: ClamAV Plugin Question
Posted by Mark Martinec <Ma...@ijs.si>.
On Tuesday January 5 2010 14:45:30 Art Greenberg wrote:
> I saw this plugin listed in the SA Wiki, and contacted the author listed
> in the Wiki about this issue. Seems he's disowned the thing, and he
> suggested asking here. Is anyone on the list using this plugin?
>
> I just installed the ClamAV plugin for SpamAssassin. This is a fresh
> install of SpamAssassin-3.3.0-rc1 and ClamAV-0.95.3 with Postfix on CentOS
> 5.4. I'm using procmail via .forward to interface with SA. This server is
> a home server with just a few email accounts being handled on it.
>
> SA and ClamAV both seem to be scanning email and otherwise working
> properly, except that the ClamAV plugin is inserting the X-Spam-Virus
> header twice. Messages with a virus found are showing it first with "No"
> and the second time with "Yes". In messages where no virus is detected, it
> is "No" both times. The second instance immediately follows the first. The
> report inserted into the header by SA only shows the ClamAV result once
> and only when a virus is detected, and it looks like SA properly scores
> it.
The issue is already tracked as:
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6254
Will look into it...
Mark