[Rspamd-Users] ClamAV and rspamd : log question

[Vsevolod Stakhov]

On 20/02/2023 10:30, Mickaël Dequidt wrote:
> Hello all,
> 
> 
>> If your guess is correct it seems in conflict with the documentation,
>> which says that greylisting takes place at the SMTP DATA stage, while
>> scanning takes place later in the conversation, at EOM.  See paragraph
>> headed "The order of checks" in
>>
>> https://rspamd.com/rmilter/configuration.html
>>
>> which I interpret to mean that for a greylisted message no virus scan
>> will yet have taken place - but that doesn't seem to be what you see
>> in the logs.
>>
> 
> I would have interpreted that way as well, and that's the general way of 
> implementing greylisting, as I reckon. But the greylisting module of 
> rspamd doesn't seem to behave like the obsoleted rmilter.
> 
> I use clamav directly through the antivirus module, and after having 
> activated debugging for this module, I can now confirm that greylisting 
> is evaluated at the same time as other modules, during the actual and 
> complete analysis of a message. 

Rspamd greylisting is adaptive: it means that the decision to greylist 
depends on a message's spam score. Presumably, expensive checks, such as 
AV checks must be executed after greylisting pass or there should be a 
way to enable old behaviour of non-selective greylisting. I would prefer 
the first option though - a clever greylisting with no expensive checks :)