Craig wrote: > I have been testing a postfix/amavisd-new/ClamAV/F-Prot setup for the past > month. I thought everything was going ok until I noticed any mail received > from "[EMAIL PROTECTED]" was not being scanned by the > virus scanners, all other mails are scanned. I set the log_Level to 5 and > this is the only log entry that referenced the virus scanners:
> "Oct 4 13:22:32 mx1 amavis[50996]: (50996-10) virus_presence cached, > skipping virus_scan" > I thought all mail would get scanned unless you setup > @bypass_virus_checks_maps, @bypass_spam_checks_maps, > @bypass_banned_checks_maps, etc. Of course none of these are in use, as this > is a very basic setup for the time being. > Is this to be expected for some reason? I searched the archives, but was > unable to find anything. > Craig If you take a particular message, then scan it for viruses, and it comes up clean, there is an efficiency advantage in not scanning every copy of the very same message (body) that comes through your system (at least for a short while). The same applies to spam. Conversely, if it was infected/spam, every copy would be marked as infected/spam. from amavisd-conf.sample: # expiration time of cached results: time to live in seconds # (how long the result of a virus/spam test remains valid) $virus_check_negative_ttl= 3*60; # time to remember that mail was not infected $virus_check_positive_ttl= 30*60; # time to remember that mail was infected $spam_check_negative_ttl = 30*60; # time to remember that mail was not spam $spam_check_positive_ttl = 30*60; # time to remember that mail was spam # # NOTE: # Cache size will be determined by the largest of the $*_ttl values. # Depending on the mail rate, the cache database may grow quite large. # Reasonable compromise for the max value is 15 minutes to 2 hours. Also from the source code: # spam level and spam report may be influenced by mail header, not only # by mail body, so caching based on body is only a close approximation; Gary V ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
