Hello Diethmar,

so far i have not yet noticed something llike that, but if this is an issue, we have problem. 

During the last update, we updated the Bitdefender API.

It should now be bumped to version: 

BitDefender bdavserver version 3.3.2

If you execute this command on your SMG Server, you should be able to verify, which version your SMG service is using.

/opt/microfocus/smg/services/av-as/app/bdamserver -version

Besides checking the actual In-Use version, for troubleshooting purposes monitoring the API scans and results we get back from Bitdefender might be an option to check if the results are now 'worse' than with the older API.

Therefor you could enable a more verbose logging on the SMG-level. 

In the file bdasserver.conf, which you can find  below /opt/microfocus/smg/services/av-as/app directory there are logging options.

#PathLog=/opt/microfocus/smg/services/logs/bdas.log
PathLog=/vastorage/smg/services/logs/bdas.log
#PathLog=

# Enables debugging log. Grows up very fast, do not use for production!
#
LogDebug=1

# Enables scan request logging.
#
LogScanRequests=1

# Enables opening the log file in APPEND mode. Do not enable on NFS!
#
LogAppend=0

If you enable these 3 options, or 4 if you like appending on log-files, after a SMG-service restart via '$ service smg restart' you should get more information on what actually is communicated between SMG and the Bitdefender API and are able to see if there are communication-problems appearing.

Thank you,

Georg

Well, my server seems to be on current version. I will enable logging ...

I see something like that:

Tue Aug 15 17:55:52 2023 [B0AF1100] DEBUG: Starting client thread
Tue Aug 15 17:55:52 2023 [AB73B700] DEBUG: A new client connection thread is started successfully
Tue Aug 15 17:55:52 2023 [AB73B700] ERROR: Invalid scan options: anti-malware license is not configured, but anti-malware related scan options are present: 0x00000000
Tue Aug 15 17:55:52 2023 [B0AF1100] DEBUG: Accepted a new Unix socket connection at /vastorage/smg/services/av-as/app/bdassock
Tue Aug 15 17:55:52 2023 [B0AF1100] DEBUG: Starting client thread
Tue Aug 15 17:55:52 2023 [B0AF1100] DEBUG: Accepted a new Unix socket connection at /vastorage/smg/services/av-as/app/bdassock
Tue Aug 15 17:55:52 2023 [B0AF1100] DEBUG: Starting client thread

A successful scan in the logs, would look something like this:

Mon Aug 14 12:55:34 2023 [6DB48100] DEBUG: Accepted a new Unix socket
connection at /vastorage/smg/services/av-as/app/bdassock
Mon Aug 14 12:55:34 2023 [6DB48100] DEBUG: Starting client thread
Mon Aug 14 12:55:34 2023 [683CF700] DEBUG: A new client connection
thread is started successfully
Mon Aug 14 12:55:34 2023 [687D1700] DEBUG: A new client connection
thread is started successfully
Mon Aug 14 12:55:34 2023 [687D1700] SCAN: Scanning file
/opt/microfocus/smg/smg-smtp/private/1_11011/temp/~3v62v7vho0.71idk216948fusg63d.tmp
for spam
Mon Aug 14 12:55:34 2023 [687D1700] DEBUG: AntiSpam SDK: scan succeed,
result 00000000, header Build: [Engines: 2.17.4.1488, Stamp: 3], Multi:
[Enabled, t: (0.000021,0.006722)], BW: [Enabled, t:
(0.000027,0.000001)], RTDA: [Enabled, t: (0.076349), Hit: No, Details:
v2.56.0; Id: 15.vlnn8.1h7pqvm0o.47f3; mclb;
wl[sign_wl(99f91655f35e9db05a099af0cefec56f:ai)]], total: 0(775)
Mon Aug 14 12:55:34 2023 [687D1700] SCAN: Anti-spam scan completed for
file
/opt/microfocus/smg/smg-smtp/private/1_11011/temp/~3v62v7vho0.71idk216948fusg63d.tmp,
status: CLEAN
Mon Aug 14 12:55:34 2023 [687D1700] DEBUG: Scan took 84msec
Mon Aug 14 12:55:34 2023 [687D1700] DEBUG: Client closed connection
(read).

Also should be lines in that log-file  indicating the correct loaded license:
Mon Aug 14 12:50:07 2023 [6DB48100] INFO: Configured licenses
functionality: "antispam"

As this goes very much into detail, let us discuss this further via your already opened service-request, so we can present our solution here, once we have found the cause of the bad spam detection.

we have the same issues

BitDefender bdavserver version 3.3.2, Copyright (C) BitDefender SRL 2009-2023, built at Jun 30 2023, 15:41:29

Wed Aug 16 11:20:54 2023 [5D159100] DEBUG: Accepted a new Unix socket connection at /vastorage/smg/services/av-as/app/bdassock
Wed Aug 16 11:20:54 2023 [5D159100] DEBUG: Starting client thread
Wed Aug 16 11:20:54 2023 [53FFF700] DEBUG: A new client connection thread is started successfully
Wed Aug 16 11:20:54 2023 [5D159100] DEBUG: Accepted a new Unix socket connection at /vastorage/smg/services/av-as/app/bdassock
Wed Aug 16 11:20:54 2023 [5D159100] DEBUG: Starting client thread
Wed Aug 16 11:20:54 2023 [53DFE700] DEBUG: A new client connection thread is started successfully
Wed Aug 16 11:20:54 2023 [53DFE700] ERROR: Invalid scan options: anti-malware license is not configured, but anti-malware related scan options are present: 0x00000000
Wed Aug 16 11:20:54 2023 [53DFE700] DEBUG: Client closed connection (read).
Wed Aug 16 11:20:54 2023 [53DFE700] DEBUG: Exiting client thread

i've installed a new SMG with the most current OVA Image for testing purpuse.

and bitdefender is working

 A new client connection thread is started successfully
Tue Aug  8 16:39:18 2023 [8C77E700] SCAN: Scanning file /opt/microfocus/smg/smg-smtp/private/1_11010/temp/~3v7s1vvto0.11id4ksm6ud01673kvd.tmp for spam
Tue Aug  8 16:39:19 2023 [8C77E700] DEBUG: AntiSpam SDK: scan succeed, result 00000000, header  Build: [Engines: 2.17.4.1488, Stamp: 3], Multi: [Enabled, t: (0.000004,0.011131)], BW: [Enabled, t: (0.000013)], RTDA: [Enabled, t: (0.937655), Hit: No, Details: v2.56.0; Id: 15.zr47v.1h7usdd8q.3m2f; mclb], total: 0(775)
Tue Aug  8 16:39:19 2023 [8C77E700] SCAN: Anti-spam scan completed for file /opt/microfocus/smg/smg-smtp/private/1_11010/temp/~3v7s1vvto0.11id4ksm6ud01673kvd.tmp, status: CLEAN
Tue Aug  8 16:39:19 2023 [8C77E700] DEBUG: Scan took 963msec
Tue Aug  8 16:39:19 2023 [8C77E700] DEBUG: Client closed connection (read).
Tue Aug  8 16:39:19 2023 [8C77E700] DEBUG: Exiting client thread

The difference is - I and others updated to current version. And it was working before ...

we have the same issue with all updated machines too

I hope Georg and devs are working in the background 

How is it possible, that the devs obviously did not test update to new version?

How is it possible, that the devs obviously did not test update to new version?