Hi, > We get this (or something like it) in the maillog on a regular basis: > > Jul 30 06:35:28 spamhost amavis[1516]: (01516-18) cached > fa63a14bcc69e31f69e554579f645969 from > <[EMAIL PROTECTED]> (1,0,1)
amavis can keep a cache hashes of mails with the corresponding diagnosis (virus/clean/spam). Any mail that has a hash identical with one in the cache won't be rescanned, but the corresponding diagnosis from the cache will be used. Check your settings on the following variables to tune this: $enable_global_cache, $virus_check_negative_ttl, $virus_check_positive_ttl, $spam_check_negative_ttl, $spam_check_positive_ttl > In many cases, it appears that this doesn't cause a problem. However, > recently, we began to notice that truly CRAP SPAM messages are getting > through the system and delivered to users. The 3 strange things about > this are: > > 1) The overall score is incredibly negative, -80 or below as if the > sender or some other part of the message was white listed... Which would mean that either you have a hash collision, would would be very unprobable, or the first mail that got hashed and cached came from a whitelisted sender. > 2) There is no associated 'amavis spam_scan:' log entry... > 3) In looking at the TIMING output, we see no indication of > SA checks or > any other SA related activity...just Postfix, SMTP, etc. > timing stats... Both due to amavis skipping the scan, since it found an entry in the cache. Depending on how much mail flows through your server(s), you might want to either turn off the cache (be prepared for a performance hit though) or turn down the cache ttls. Regs, Sven ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
