Quarantine digests

[jgoldschrafe]

I keep getting this crap probably 80 times a day:

VIRUS ALERT

Our content checker found
virus: Trojan.Agent-49495

in an email to you from unknown sender:
?@[88.236.150.97]
claiming to be: <dlebenson@pocanticohills.org>

Content type: Virus
Our internal reference code for your message is 21755-08/TSwMotRON67q

First upstream SMTP client IP address: [88.236.150.97] unknown
According to a 'Received:' trace, the message originated at: [88.236.150.97],
[88.236.150.97] (unknown [88.236.150.97])

Return-Path: <dlebenson@pocanticohills.org>
User-Agent: Thunderbird 2.0.0.12 (Windows/20080213)
Message-ID: <93945.sarah@moon-jun>
Subject: You have received an eCard
The message has been quarantined as: virus-TSwMotRON67q

Please contact your system administrator for details.

This sort of defeats the purpose of me having a spam filtering MTA in the first place. Is there anything I can turn on to get quarantine digests once a day?

[lcxe]

I think the easiest thing you could do it just create a mail filter and have everything containing "VIRUS" in the subject line filtered into a folder.

[jgoldschrafe]

Originally Posted by lcxe

I think the easiest thing you could do it just create a mail filter and have everything containing "VIRUS" in the subject line filtered into a folder.

Me and each of my users, individually.

That makes this not an attractive option.

[Rich Graves]

In the admin console (https://server:7071/) go to Global Settings => AS/AV and uncheck "Send notification to recipient."

The default is *not* checked. You or some other admin must have changed it.

Notifications will still go to admin@server.

[mmorse]

There's actually several attributes when it comes to notifying the admin:
zimbraVirusWarnAdmin: TRUE
zimbraVirusWarnRecipient: TRUE
av_notify_user = admin@server.domain.com
smtp_destination = admin@server.domain.com
smtp_source = admin@server.domain.com
zimbraBackupReportEmailRecipients: admin@server.domain.com
zimbraBackupReportEmailSender: admin@server.domain.com

jgoldschrafe you can disable this for just users, just admin address, or both:

su - zimbra
zmprov mcf zimbraVirusWarnRecipient FALSE
zmprov mcf zimbraVirusWarnAdmin FALSE