Spam Detection versus Reputation Filtering Change

[rlw]

I have noticed in our reporting on our C170 clustered appliances that since the beginning of 2013 there has been a dramatic shift in how email is addressed. In December 2012 almost 90% of email was blocked based upon reputation filtering; 3% - 5% was quarantined as spam; and only 8% - 10% was clean. Now Jan - Apr 2013 only 2% stopped by reputation; 56% quarantined as spam; and 40% clean. Has their been a change in how email is handled, or are our appliances no longer working?                   

[ironport99 · Accepted solution]

Sounds similar to an issue we were having where an SenderBase update in December stopped SBRS lookups working.

If you look in you mail logs and see something like "SBRS - unable to retrieve" then you probably have the issue.

In the CLI you can run :                  repengstatus                          to see the last download/update time of SBRS

If this is out of date then run:           repengupdate force

We still needed a reboot after that to get it working.

Upgrade to 7.6.2 fixes the problem in the future.

[rlw]

We are running 7.6.2; however, when I checked the SBRS status it was dated Jan 25 which incidently was when we upgraded to that version. It seems that it stopped working at that time. I forced an update and now have the current. After rebooting, we will see if it updates automatically or if we still have a problem. Thanks for the tip!

[Doug Maxfield]

Daryl,

Are you able to confirm that after the reboot that your SBRS updates are happening?  We updated to 7.6.2 in Jan and Feb and running the commands you gave shows that our Reputation Engine stopped updating on the date the update was installed on each of our appliances.

We reboot these weekly, so I'm hoping after forcing the update that it will happen on its own.

Thanks!!