Spam question (all related)

[dlochart]

Before I get slammed with RTFM please remember mail admin is NOT my area I am just being asked to help solve a problem as fast as I can.

layout: Zimbra 4.5 on RHEL 4 (plenty of memory)

Split configuration:
1 MTA (only mail, spam etc)
1 MailStore, LDAP, etc

First of all I am trying to determine why some obvious spam is getting through.

1) Whenever I do a zmcontrol status on the MailStore the logger is always not running (have to restart it). There is no logger on the MTA (as far as I can see) in a split config should the loggers be installed and running on both? (I ask as I do not see any spam related logs) I see clamd, freshclam, and spamtrain but not logs showing me that spamassassin/amavis is doing (or not ) doing its thing.

2) I tried sending the spam through our similarly configured test env and I cannot get it to go through, I keep getting a BOUNCE message in the maillog. I am trying to use telnet from a different internal host. Any tips on me getting this to go through?

3) The clients are using Outlook. Am I right in saying that in order for the users to submit spam to train the system they will have to explicitly forward it to the zimbra spam lover email account? I know in the web interface you place it in junk and it forwards it to that account.

Thanks for any tips. I can provide more detail so ask if you need it

Doug

[mmorse]

There is no logger on the MTA (as far as I can see) in a split config should the loggers be installed and running on both?

Negative-the logger runs on one mailstore only. Please give us more info on your logger stopping. (start with your zimbra version zmcontrol -v and any related logs at that time)

Spam/Junk: The main method to train spam assassin is to hit the junk button (yes from the webclient).
You can run this: to forward/process a whole folder of junk at once: CLI zmtrainsa - ZimbraWiki
There is a cron job to feed mail that has been classified as spam or as non-spam to the SpamAssassin application daily.

Now, just placing in the junk folder from outlook:

Originally Posted by phoenix

You need to hit the Junk button on an email for it to also go to the spam folder, obviously the reverse is true for a message in the junk folder - you must hit the Not Junk for it to get trained as ham. The drag/drop doesn't have the same function.

[dlochart]

First off thanks for the quick reply!

Originally Posted by mmorse

Negative-the logger runs on one mailstore only. Please give us more info on your logger stopping. (start with your zimbra version zmcontrol -v and any related logs at that time)

Versions:

prod: Release 4.5.4_GA_763.RHEL4_64_20070323155546 RHEL4_64 NETWORK edition

test: Release 4.5.5_GA_838.RHEL4_20070503171738 CentOS4 NETWORK edition

I do not know what to look for in logs to give you anything related. I grepped for zmlogswatchctl in the logs but did not see any mention. All I know is whenever I look at the status through the admin UI (more often than not) the logger is not running on either test or prod.

Question The logger needs to be running for statistics to be available correct? We never seem to be able to see many of them (message count, volume, spam)

Question
If the logger is running ( on the mail store ) will I see a log file specific for spam activity even if the logger is on the mail store and SA is on the MTA ??

Originally Posted by mmorse

Spam/Junk: The main method to train spam assassin is to hit the junk button (yes from the webclient).
You can run this: to forward/process a whole folder of junk at once: CLI zmtrainsa - ZimbraWiki
There is a cron job to feed mail that has been classified as spam or as non-spam to the SpamAssassin application daily.

Now, just placing in the junk folder from outlook:

I see the quote you added in from another thread but that thread does not reference Outlook specifically. The users DO NOT use the web client at all and so far our experience with the Connector has not been a good one so needless to say I do not trust that putting the email in Outlooks junk will accomplish anything. Please tell me if it is otherwise. If it does not work then can I simply have the users forward the email to our spam account?

thanks

[dlochart]

Bump!

I seem to have resolved my initial spam issue but I am still looking for answers to the logger stopping.

It has been running now for a day ... shouldn't I see some server stats in the admin console for spam then?