Amavis doesn't seem to work

[mludvig]

Hi all,

I've got Zimbra 5.0.5 on RHEL 5 and I suspect Amavis doesn't work. In Admin console in Monitoring->Server Statistics->AntiSpam AntiVirus graph I can see some AV/AS traffic back in May for a few weeks but nothing since then (we've deployed Zimbra from May). In Monitoring->Server Status both AV and AS services seem to be up.

In the emails in my Inbox I can see some AV/AS headers:

Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.my-domain.co.nz (Postfix) with ESMTP id BA7D31008C2
for <me@my-domain.co.nz>; Thu, 21 Aug 2008 14:47:55 +1200 (NZST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.398
X-Spam-Level:
X-Spam-Status: No, score=-4.398 tagged_above=-10 required=6.6
tests=[ALL_TRUSTED=-1.8, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from mail.my-domain.co.nz ([127.0.0.1])
by localhost (mail.my-domain.co.nz [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 5LO37gisS0LW for <me@my-domain.co.nz>;
Thu, 21 Aug 2008 14:47:54 +1200 (NZST)


1) I wonder why the "X-Virus-Scanned:" header says only "amavisd-new at" and that's it, no host name or anything.

2) It probably kills spams but we've recently got some viruses through. How can I tell whether the virus DB is being updated regularly?

3) Why it doesn't show any recent stats in the Monitoring graphs?

Thanks for any hints

[Jbrabander]

I've wondered about this too. I know we've gotten some virused emails in lately, we get a notice from the server in our inbox when something gets caught. But when I look at the server stats, there's nothing "red" in the activity for the last 30 days, which is suppose to indicate an email with a virus. And the stat for the last 48 hours only shows a message count of 1.0 over the last 48 hours? And nothing ever has shown in any graph on the spam count.

[Jbrabander]

Anyone got any ideas?

[Zoltan67]

Same problem here, spam and antivirus activity is nearly inexistant compared to the amount of spam and infected mails we receive... is there a problem ?

[uxbod]

2) It probably kills spams but we've recently got some viruses through. How can I tell whether the virus DB is being updated regularly?

Viruses may get through as it will all depend on whether a signature has been written by the Clam team or one of its contributors. Personally I would like to see ZCS support additional AV scanners, hence why I personally run a MailScanner installation in front off ZCS with three scanners configured.

[SchlingBlade]

Any reason to not update to 5.0.9, mludvig? I believe the AV engine has been updated since then.