Spam - More spam since IP change

[Roman B.]

Greetings

Recently we have reconfigured our network layout. I have had several users complain of receiving even more junk mail since this change. Would there be any reason for this spam increase? Also, We are currently running spamassasin and spam seems to still be coming to users inbox i.e. "******". We have been having out users to move the spam they are getting to the junk folder in hopes to eliminate the issue. Is there anything we can do decrease junk?

[abhiz]

Please update your profile,What version of ZCS your are using

run this command

zmcontrol -v

[yar0]

Hello,

I have the same problem. I changed IP address of mail server, and since then I get much more spam than before.
And also after this I can't start stats service:

[zimbra@mail ~]$ zmstatctl start
Invoking: /opt/zimbra/libexec/zmstat-proc
Invoking: /opt/zimbra/libexec/zmstat-cpu
Invoking: /opt/zimbra/libexec/zmstat-vm
Invoking: /opt/zimbra/libexec/zmstat-io -x
Invoking: /opt/zimbra/libexec/zmstat-df
Invoking: /opt/zimbra/libexec/zmstat-io
Invoking: /opt/zimbra/libexec/zmstat-fd
Invoking: /opt/zimbra/libexec/zmstat-allprocs
Invoking: /opt/zimbra/libexec/zmstat-mysql
Invoking: /opt/zimbra/libexec/zmstat-convertd
Invoking: /opt/zimbra/libexec/zmstat-mtaqueue

[zimbra@mail ~]$ zmcontrol status
Host mail.*.*
antispam Running
antivirus Running
ldap Running
logger Running
mailbox Running
mta Running
snmp Running
spell Running
stats Stopped

And I don't know, if it's connected with IP changing.

[uxbod]

If you are having SPAM issues then you need to provide us with the headers from one of the emails. We have no way of knowing otherwise which and which not rules are being hit.

[yar0]

This is it - email header:

Return-Path: boitumeloalice@my-domain.com
Received: from mail.my-domain.com (LHLO mail.my-domain.com)
(X.X.X.X) by mail.my-domain.com with LMTP; Sun, 9 May 2010
20:38:02 +0200 (CEST)
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.my-domain.com (Postfix) with ESMTP id F133CB7BC80
for <name@my-domain.com>; Sun, 9 May 2010 20:38:01 +0200 (CEST)
X-Virus-Scanned: amavisd-new at my-domain.com
X-Spam-Flag: NO
X-Spam-Score: 6.351
X-Spam-Level: ******
X-Spam-Status: No, score=6.351 tagged_above=-10 required=6.6
tests=[BAYES_99=3.5, DOS_OE_TO_MX=2.75, RDNS_DYNAMIC=0.1,
STOX_REPLY_TYPE=0.001] autolearn=no
Received: from mail.my-domain.com ([127.0.0.1])
by localhost (mail.my-domain.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id s1FEtV-iTtgc; Sun, 9 May 2010 20:38:01 +0200 (CEST)
Received: from company3b457bd (net-188-216-24-49.cust.dsl.vodafone.it [188.216.24.49])
by mail.my-domain.com (Postfix) with ESMTP id EDA46B7BC7A
for <alias@my-domain.com>; Sun, 9 May 2010 20:38:00 +0200 (CEST)
Message-ID: <000e01caefbb$479bb4f0$7f000001@company3b457bd>
From: "Boitumelo Alice" <boitumeloalice@my-domain.com>
To: <alias@my-domain.com>
Subject: Your order of a Degree
Date: Sun, 9 May 2010 21:04:50 +0200
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="koi8-r";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-EsetId: 7557932AB90F5E696A51937EB2551A

[uxbod]

Search the forums for SaneSecurity and use their additional ClamAV signatures.

[yar0]

OK, thanks, but I can't find any information, how to use it with zimbra.

I have downloaded SaneSecurity script and then edited file: clamav-unofficial-sigs.conf

I found, that clamav use "/opt/zimbra/data/clamav/db" dir for signature files.
So I put this in the configuration. And I set user and group as zimbra:

clam_user="zimbra"
clam_group="zimbra"
clam_dbs="/opt/zimbra/data/clamav/db"

When I run this script:
clamav-unofficial-sigs.sh -c clamav-unofficial-sigs.conf
nothink happend with clamav db files. Why?

Should I set also somethink else in configuration file?

[uxbod]

These are the the items that need to be set within the configuration file

PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/zimbra/clamav/bin"

clam_user="zimbra"
clam_group="zimbra"

clam_dbs="/opt/zimbra/data/clamav/db"

clamd_pid="/opt/zimbra/log/clamd.pid"

And the most important line is at the end of the file

user_configuration_complete="yes"