This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange

Question:

How is the MailMarshal SpamCensor updated?

Procedure:

MailMarshal updates components of the SpamCensor and other XML Category based conditions using HTTP and HTTPS.  This requires MailMarshal to be able to access the Internet using ports 80 and 443 respectively. 

Note: MailMarshal Exchange 7.X updates the Known Threats component only, and NOT SpamCensor.

You can set proxy server options, if necessary, using the MailMarshal Configurator or MailMarshal (SEG) 10 Management Console.  See Array Properties (or MailMarshal Properties) > Internet Access.

• These updates are retrieved from the Array Manager and NOT from the nodes.

By default MailMarshal checks for updates hourly (less frequently in earlier versions), and if necessary downloads updated files.

The update process is as follows:

1. MailMarshal polls the Web site https://www.marshal.com/ supplying the version of the product.
   • Note: this older domain remains correct for all versions. The full URL path used depends on the product version.
2. The Trustwave web server replies with an XML file containing a list of all the file updates that are available for the version of MailMarshal, and links to the files. 
3. MailMarshal then compares the update versions available with the versions currently installed. 
4. If any of the files are out of date, MailMarshal proceeds to download the updates from http://www.marshal.com
5. When all of the updates have been downloaded MailMarshal deploys them, and issues a rule reload. 
6. If any of the files cannot be downloaded, then none of the files are deployed. 

The files that are downloaded may be enhancements to the encrypted category scripts (XML files), or occasionally changes to the category engine itself (DLLs). These items are stored in the Config subdirectory of the MailMarshal install directory.

You can check the update status and start the update process manually using the MailMarshal Configurator or the Management Console.  Navigate to Array Properties > Automatic Updates, and click Update Now. You will be informed that the configuration is already up to date, or that an update has been performed.

Notes:

• Due to security enhancements in Windows, HTTPS access to www.marshal.com now also requires access to the Certificate Revocation List server maintained by the issuer of Marshal's SSL certificate. The address required is https://crl.trustwave.com
• The update process does not change any items visible in the Configurator (Rules or Rule elements). The update affects the definitions and engine used by the Rule condition "Where message is categorized as Spam" (or other categories).
• See the following Trustwave Knowledgebase article for more information: Q11718: Why do SpamCensor updates fail?

This article was previously published as:

NETIQKB29672

Marshal KB487