Re: [Spamprobe-users] SpamProbe + ClamAV

[Brian B. <bb...@us...>]

On 1/28/07 4:33 AM, "Nikolaus Hiebaum" <ne...@hi...> wrote:
> A while ago, I asked a question here regarding an obscure ClamAV error th=
at
> happens in combination with SpamProbe. Well, nobody replied; hence, I'll =
try
> again ...

Probably because people didn't consider it to be a SpamProbe question.


> I am running SpamProbe 1.4d and ClamAV 0.88.7 on my system (a shared
> FreeBSD server). Both SpamProbe and ClamAV are invoked through a .procmai=
lrc
> rule. In general, my .procmailrc-setup looks like this:
>=20
> 1) Run everything through ClamAV (via Clamassassin)
> 2) Check if mails are for mailing lists and shuffle them in the respective
> folder
> 3) Run SpamProbe
> 4) Do more mail shuffling
>=20
> Every now and then it happens that e-mails get "destroyed" and there is an
> obscure error in the mail header: Clamscan error 137.

I have been running clamscan followed by SpamProbe for years now and have
never encountered this issue.  I have not used clamassassin so I have no
idea what that really does, I simply run clamscan directly to set a header
and reroute virus mails then run spamprobe on anything not identified as a
virus.

If you are seeing emails destroyed then you should use a rule in your
procmailrc to save a backup of every email for a while then when one gets
destroyed look for the original in your backup folder.  That way you might
be able to see something interesting about that email and test that email
directly by running clamscan (or whatever) on it by hand.

> So, my question is if anyone of you has an idea what could be the cause o=
f the
> problem. Also, what would you suggest in terms of order and processing
> efficiency of ClamAV & SpamProbe.

No ideas.  As I said above I have always run clamscan first and then
spamprobe.  I do train on the virus mails by having cron run a spamprobe
train-spam of the virus folder.

All the best,
++Brian