This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[SFOS 18.5MR3] Poor spam detection after update to Sophos Anti-Spam Interface

Hi everyone,
I am setting up a separate thread as I did not receive any specific reply in other threads.

The case concerns Sophos Anti-Spam Interface after upgrading from v18.5MR2 to v18.5MR3 and from v19EAP1 to v19EAP2.

Before updating, antispam works great in legacy mode, detects a lot of intrusive messages and tags with a prefix (near 99%). After updating, only some messages are detected as spam and tagged (I did not do any changes in configuration).

What it comes from? How can I edit my lists to achieve pre-update spam detection?

Greetings

This thread was automatically locked due to age.

Top Replies

Karlos over 2 years ago in reply to Bart van der Horst +3 suggested

Just to update this thread, RE: NC-90702, development will include a fix in SFOS 18.5 MR4 and 19.0 MR1.

Parents

0 LuCar Toni over 2 years ago

I am curious.

Are only Home Users seeing this issue? Because it looks like, only Home Appliance are affected by this potential issue. Or does somebody with a Appliance (SG/XG/XGS) have the same issue?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 2 years ago

I am curious.

Are only Home Users seeing this issue? Because it looks like, only Home Appliance are affected by this potential issue. Or does somebody with a Appliance (SG/XG/XGS) have the same issue?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Michele Di Dio over 2 years ago in reply to LuCar Toni

Helo,

i have a Virtuell Home Appliance and at Work a brand new 116 XGS. And Yes i have the same Problems with spam.

So i rollback on both Appliance to 18.5MR2 380 and all Works fine.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 2 years ago in reply to LuCar Toni

Hi,

screenshots from the sasi.log this morning on my XG115W

What the XG pattern update shows.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Peter-Paul Gras over 2 years ago in reply to LuCar Toni

I am a Home User, setup SFOS in MTA mode.
I do not experience more spam coming through then before the upgrade to 18.5 MR3.

Behind the XG is a mailserver with a second line of spam defence, that doesn't show an increase in activity either.

SFVH (SFOS 20.0.0 GA-Build222) - Last (re)boot on November 6th 2023

Asus H410i-plus - Pentium 6605 Gold - 250GB M.2 PCIe NVMe SSD - 8GB - 3 ports

[If any of my posts are helpful to you please use the 'Verify Answer' link]
Cancel
Vote Up 0 Vote Down

Cancel
0 EdmundSackbauer over 2 years ago in reply to Peter-Paul Gras

Same here, but what I noticed is I don't get any confirmed spam in quarantine anymore, and probable spam is not tagged with [SPAM]. Seems those mails are not processed by spam engine and go straight through to my mail server.
What works is the RDNS and RBL checks.
Cancel
Vote Up +1 Vote Down

Cancel
0 Bart van der Horst over 2 years ago in reply to LuCar Toni

Hi LuCar Toni,

I've got a few customers upgraded to MR3, one off them has this problem and so am I with my LAB/Home version. Customer is xg210 with paid license. The thing that's the same is we both do IPv6 on the in and outside.

Opened case Nr: 05143473

Bart.

Bart van der Horst

Sophos XG v18-v21 Certified Architect
Cancel
Vote Up 0 Vote Down

Cancel
0 EdmundSackbauer over 2 years ago in reply to EdmundSackbauer

Ok it seems its now working for me. It seems Antispam service was not running properly. Monitoring was not complaining and under "System Services" it was shown as "Running". I tried to stop it, but I got an error.

The solution: Restarted my firewall, and turned off and on the Antispam function in my SMTP policy. Since then spam is properly sent to quarantine or tagged with [SPAM] again.
Cancel
Vote Up 0 Vote Down

Cancel
0 darnoK over 2 years ago in reply to EdmundSackbauer

I confirm this solution. It's a temporary solution, but it works. Stop SPAM rule, stop SASI service, start SASI and start SPAM rule. Working sice yesterday. E-mails are tagged properly. It works also in v19EAP2.
Cancel
Vote Up 0 Vote Down

Cancel
0 darnoK over 2 years ago in reply to darnoK

And unfortunately stops working :/
Cancel
Vote Up 0 Vote Down

Cancel
0 EdmundSackbauer over 2 years ago in reply to darnoK

For me its still working, I can see I get all X-SASI headers in the incoming emails. Maybe you need to restart the firewall as I did.
Cancel
Vote Up 0 Vote Down

Cancel
0 Karlos over 2 years ago in reply to Bart van der Horst

This issue has been assigned Development Reference ID NC-90702 and we will keep this post updated as we get more information.

Best,

Karlos
Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel