Seems to be good: Apr 29 14:21:40 srv1 amavis[6523]: Module Amavis::Conf 2.303 Apr 29 14:21:40 srv1 amavis[6523]: Module Archive::Zip 1.39 Apr 29 14:21:40 srv1 amavis[6523]: Module BerkeleyDB 0.54 Apr 29 14:21:40 srv1 amavis[6523]: Module Compress::Zlib 2.064 Apr 29 14:21:40 srv1 amavis[6523]: Module Convert::TNEF 0.18 Apr 29 14:21:40 srv1 amavis[6523]: Module Convert::UUlib 1.4 Apr 29 14:21:40 srv1 amavis[6523]: Module Crypt::OpenSSL::RSA 0.28 Apr 29 14:21:40 srv1 amavis[6523]: Module DBD::mysql 4.028 Apr 29 14:21:40 srv1 amavis[6523]: Module DBI 1.631 Apr 29 14:21:40 srv1 amavis[6523]: Module DB_File 1.831 Apr 29 14:21:40 srv1 amavis[6523]: Module Digest::MD5 2.53 Apr 29 14:21:40 srv1 amavis[6523]: Module Digest::SHA 5.88 Apr 29 14:21:40 srv1 amavis[6523]: Module File::Temp 0.2304 Apr 29 14:21:40 srv1 amavis[6523]: Module IO::Socket::INET6 2.72 Apr 29 14:21:40 srv1 amavis[6523]: Module MIME::Entity 5.505 Apr 29 14:21:40 srv1 amavis[6523]: Module MIME:arser 5.505 Apr 29 14:21:40 srv1 amavis[6523]: Module MIME::Tools 5.505 Apr 29 14:21:40 srv1 amavis[6523]: Module Mail:KIM::Signer 0.4 Apr 29 14:21:40 srv1 amavis[6523]: Module Mail:KIM::Verifier 0.4 Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::Header 2.13 Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::Internet 2.13 Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::SPF v2.009 Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::SpamAssassin 3.004000 Apr 29 14:21:40 srv1 amavis[6523]: Module Net:NS 0.81 Apr 29 14:21:40 srv1 amavis[6523]: Module Net::Server 2.008 Apr 29 14:21:40 srv1 amavis[6523]: Module NetAddr::IP 4.075 Apr 29 14:21:40 srv1 amavis[6523]: Module Razor2::Client::Version 2.84 Apr 29 14:21:40 srv1 amavis[6523]: Module Socket6 0.25 Apr 29 14:21:40 srv1 amavis[6523]: Module Time::HiRes 1.9726 Apr 29 14:21:40 srv1 amavis[6523]: Module URI 1.64 Apr 29 14:21:40 srv1 amavis[6523]: Module Unix::Syslog 1.1 Apr 29 14:21:40 srv1 amavis[6523]: Amavis:B code loaded Apr 29 14:21:40 srv1 amavis[6523]: SQL base code loaded Apr 29 14:21:40 srv1 amavis[6523]: SQL::Log code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: SQL::Quarantine NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: Lookup::SQL code loaded Apr 29 14:21:40 srv1 amavis[6523]: Lookup::LDAP code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: AM.PDP-in proto code loaded Apr 29 14:21:40 srv1 amavis[6523]: SMTP-in proto code loaded Apr 29 14:21:40 srv1 amavis[6523]: Courier proto code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: SMTP-out proto code loaded Apr 29 14:21:40 srv1 amavis[6523]: Pipe-out proto code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: BSMTP-out proto code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: Local-out proto code loaded Apr 29 14:21:40 srv1 amavis[6523]: OS_Fingerprint code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: ANTI-VIRUS code loaded Apr 29 14:21:40 srv1 amavis[6523]: ANTI-SPAM code loaded Apr 29 14:21:40 srv1 amavis[6523]: ANTI-SPAM-EXT code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: ANTI-SPAM-C code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: ANTI-SPAM-SA code loaded Apr 29 14:21:40 srv1 amavis[6523]: Unpackers code loaded Apr 29 14:21:40 srv1 amavis[6523]: DKIM code loaded Apr 29 14:21:40 srv1 amavis[6523]: Tools code NOT loaded Apr 29 14:21:40 srv1 amavis[6523]: Found $file at /usr/bin/file Apr 29 14:21:40 srv1 amavis[6523]: No $altermime, not using it Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .mail Apr 29 14:21:40 srv1 amavis[6523]: No decoder for .F Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .Z at /bin/uncompress Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .gz Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .bz2 at /bin/bzip2 -d Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .xz at /usr/bin/xz -dc Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .lzma at /usr/bin/xz -dc --format=lzma Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .lzo at /usr/bin/lzop -d Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .rpm at /usr/bin/rpm2cpio Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .cpio at /bin/pax Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .tar at /bin/pax Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .deb at /usr/bin/ar Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .zip Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .kmz Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .7z at /usr/bin/7zr Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .rar at /usr/bin/unrar- Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .arj at /usr/bin/arj Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .arc at /usr/bin/nomarc Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .zoo at /usr/bin/zoo Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .doc at /usr/bin/ripole Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .cab at /usr/bin/cabext Apr 29 14:21:40 srv1 amavis[6523]: No decoder for .tnef Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .tnef Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .exe at /usr/bin/unrar- Apr 29 14:21:40 srv1 amavis[6523]: Using primary internal av scanner code for Cl Apr 29 14:21:40 srv1 amavis[6523]: Found secondary av scanner ClamAV-clamscan at Apr 29 14:21:40 srv1 amavis[6523]: Deleting db files __db.003,__db.001,nanny.db, Apr 29 14:21:40 srv1 amavis[6523]: Creating db in /var/lib/amavis/db/; BerkeleyD I've sended a mail from external to the mailbox with this body: This is the GTUBE, the Generic Test for Unsolicited Bulk Email If your spam filter supports it, the GTUBE provides a test by which you can verify that the filter is installed correctly and is detecting incoming spam. You can send yourself a test mail containing the following string of characters (in upper case and with no white spaces and line breaks): XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X You should send this test mail from an account outside of your network. It will not be filterd.... Whats wrong? Thx admins
It might just be that your test string is not supported. I never used that on amavis. Set spam tag 1 level to -100 for the spamfilter policy that you use in ispconfig, then check the header of the recieved email and the amavis line from mail.log that you get for this email.
I've following there: $sa_tag_level_deflt = -999; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 3.5; # add 'spam detected' headers at that level $sa_kill_level_deflt = 4.5; # triggers spam evasive actions $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent May I don't see the entrys wich sa shout set.
Mailheader: Received: from srv1.domain.ch ([127.0.0.1]) by localhost (srv1.domain.ch [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rv33rNw7JUjI for <empfaenger@mail>; Wed, 29 Apr 2015 14:41:40 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by srv1.domain.ch (Postfix) with ESMTP id 794421480012 for <empfaenger@mail>; Wed, 29 Apr 2015 14:41:40 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) (uid 23000) by blabla2.ch with local; Wed, 29 Apr 2015 14:41:39 +0200 id 00000000000F4014.000000005540D183.00007B46 Received: from blabla2.ch (enfront5.inf.edf.ch [IP]) by srv1.domain.ch (Postfix) with ESMTPS for <empfaenger@mail>; Wed, 29 Apr 2015 14:41:40 +0200 (CEST) Return-Path: <[email protected]2.ch> Reply-To: <[email protected]2.ch> From: <[email protected]2.ch> To: <empfaenger@mail> Subject: [SPAM] test Date: Wed, 29 Apr 2015 14:41:39 +0200 Message-ID: <[email protected]> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Thread-Index: AQDkCwwcCR0R0mbNoZ8L0j4zcsEPBg== Content-Language: de
This meal has not been scanned by amavis, otherwise it would contain a header like this: X-Virus-Scanned: Debian amavisd-new at server1.example.com Did you select a spamfilter policy in ispconfig for this mailbox? Dos this show up under spammfilter > user/domain in ispconfig and has this record set "local => yes"? Does this spamfilter policy has the spam checks enabled and is virus, spam, bad header lover set to no?
Viruslover etc. = no local = yes Mailbox yes X-Virus-Scanned header is in the mail. May no Spamassassin header entry
The x virus scanned header means that amavis incl. spamassasin has been run, there is no separate header for spam scanning. Only in case that the spam score of a email exceeds the level that is set as spam tag level in the spamfilter policy, then amavis will add detailed infos which spamfilter rules got matched in that email.
Till, do you've time to look quickly to my server? It's much faster. We can post the solution after that Stefan
Here the soluton, in case that someone finds this thread. The tests were done on port 587 and amavis had a policy bank for the submission port in its config file that disables spam scans: /ETC/AMAVIS/CONF.D/40-POLICY_BANKS: BYPASS_SPAM_CHECKS_MAPS => [1],
