From users-returnnunezjerry@example.org Mon Nov 01 05:05:08 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 27700 invoked from network); 1 Nov 2010 05:05:08 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 05:05:08 -0000 Received: (qmail 89157 invoked by uid 500); 1 Nov 2010 05:05:36 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 88961 invoked by uid 500); 1 Nov 2010 05:05:36 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 88954 invoked by uid 99); 1 Nov 2010 05:05:35 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 05:05:35 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO lo.gmane.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 05:05:28 +0000 Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from <nunezjerry@example.org>) id 1PCmZs-0001Lw-8y for nunezjerry@example.org; Mon, 01 Nov 2010 06:05:04 +0100 Received: from ip70-177-64-93.ok.ok.cox.net ([83.161.120.155]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for <nunezjerry@example.org>; Mon, 01 Nov 2010 06:05:04 +0100 Received: from support by ip70-177-64-93.ok.ok.cox.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for <nunezjerry@example.org>; Mon, 01 Nov 2010 06:05:04 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: nunezjerry@example.org From: Russ Sanders <nunezjerry@example.org> Subject: spamassassin - more children / faster scanning Date: Mon, 1 Nov 2010 04:59:26 +0000 (UTC) Lines: 28 Message-ID: <nunezjerry@example.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: nunezjerry@example.org X-Gmane-NNTP-Posting-Host: sea.gmane.org User-Agent: Loom/3.14 (http://gmane.org/) X-Loom-IP: 83.161.120.155 (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:83.161.120.155) Gecko/20101026 Firefox/3.5.15) I have an Ubuntu Linux server running SpamAssassin Server version 3.2.4 running on Perl 5.8.8 with zlib support (Compress888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4Zlib 2.008). I have at least one account that is having to process from 250 - 400 emails, 99% spam, per HOUR. This works out to be approximately 8,000 emails per day. The spamassassin just can't keep up and it is backing the Queue upto 2500 messages. I have made an adjustment so that the one user can have multiple spamd children running for it, but it doesn't seem to take on more that 2 spamd children. I have also recorded that scanning a single message appears to take approximately 15 seconds. I have adjusted the timeout to 5 seconds, but it still appears to be taking 12 - 20 second per message. This works out to 4 per minute, or 240 per hour. So, of course, it can't keep up if it has 450 per hour nunezjerry@example.org. The system is a basic Linode running Ubuntu Linux 8.04 with 512M of memory. I would like to adjust appropriately Number of Max Children Number of Spare Children Number of spamd services per account (upto max children if possible) TimeOut on Scanning of the eMail Suggestions will be appreciated. Thank You Russ From users-returnnunezjerry@example.org Mon Nov 01 07:19:19 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 87812 invoked from network); 1 Nov 2010 07:19:19 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 07:19:19 -0000 Received: (qmail 38372 invoked by uid 500); 1 Nov 2010 07:19:47 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 38194 invoked by uid 500); 1 Nov 2010 07:19:44 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 38187 invoked by uid 99); 1 Nov 2010 07:19:42 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 07:19:42 +0000 X-ASF-Spam-Status: No, hits=0.7 required=10.0 tests=SPF_NEUTRAL X-Spam-Check-By: apache.org Received-SPF: neutral (nike.apache.org: local policy) Received: from [83.161.120.155] (HELO outbound.spamchek.net) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 07:19:33 +0000 Received: from mail.enidan.com (minerva.enidan.com [83.161.120.155]) by outbound.spamchek.net (Postfix) with ESMTPA id B32BF4C3FE for <nunezjerry@example.org>; Mon, 1 Nov 2010 08:19:47 +0100 (CET) Received: from news.jessen.ch (saturn.local.net [83.161.120.155]) by mail.enidan.com (Postfix) with ESMTP id C5C395F0A9 for <nunezjerry@example.org>; Mon, 1 Nov 2010 08:19:10 +0100 (CET) Received: by news.jessen.ch (Postfix, from userid 65534) id A788953F60; Mon, 1 Nov 2010 08:19:10 +0100 (CET) X-Original-To: nunezjerry@example.org Delivered-To: nunezjerry@example.org Received: by news.jessen.ch (Postfix, from userid 9) id 955EC53F6A; Mon, 1 Nov 2010 08:19:10 +0100 (CET) From: Per Jessen <nunezjerry@example.org> X-Newsgroups: list.mail.spamassassin.general Subject: Re: spamassassin - more children / faster scanning Date: Mon, 01 Nov 2010 08:19:10 +0100 Organization: Per Jessens personal news-server Lines: 44 Message-ID: <nunezjerry@example.org> References: <nunezjerry@example.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Trace: saturn.local.net 1288595950 12249 83.161.120.155 (1 Nov 2010 07:19:10 GMT) X-Complaints-To: nunezjerry@example.org User-Agent: KNode/0.10.4 To: nunezjerry@example.org X-Virus-Checked: Checked by ClamAV on apache.org Russ Sanders wrote: > I have an Ubuntu Linux server running SpamAssassin Server version > 3.2.4 running on Perl 5.8.8 with zlib support (Compress888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4Zlib 2.008).= =20 > I have at least one account that is having to process from 250 - 400 > emails, 99% spam, per HOUR. This works out to be approximately 8,000 > emails per day. The spamassassin just can't keep up and it is backin= g > the Queue upto 2500 messages. I have made an adjustment so that the > one user can have multiple spamd children running for it, but it > doesn't seem to take on more that 2 spamd children. Does the client try to use more than two connections (to spamd) ? > I have also recorded that scanning a single message appears to take > approximately 15 seconds. I have adjusted the timeout to 5 seconds, > but it still appears to be taking 12 - 20 second per message. This > works out to 4 per minute, or 240 per hour. So, of course, it can't > keep up if it has 450 per hour nunezjerry@example.org. AFAIR, the timeout is "whilst waiting for activity", not "for the processing of an entire message". I'm guessing you're having DNS problems, or just very slow responses. If you run a message through spamassassin with -D, you'll be able to see. > The system is a basic Linode running Ubuntu Linux 8.04 with 512M of > memory.=20 How many CPUs/cores? > I would like to adjust appropriately=20 >=20 > Number of Max Children 5 is probably not unreasonable. > Number of Spare Children Not of any great importance - 1-2. /Per Jessen, Z=C3=BCrich From users-returnnunezjerry@example.org Mon Nov 01 11:55:59 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 17995 invoked from network); 1 Nov 2010 11:55:59 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 11:55:59 -0000 Received: (qmail 5290 invoked by uid 500); 1 Nov 2010 11:56:27 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 5078 invoked by uid 500); 1 Nov 2010 11:56:23 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 5069 invoked by uid 99); 1 Nov 2010 11:56:22 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 11:56:22 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO mail.ukfsn.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 11:56:14 +0000 Received: from localhost (smtp-filter.ukfsn.org [83.161.120.155]) by mail.ukfsn.org (Postfix) with ESMTP id 2ABFFDEC68 for <nunezjerry@example.org>; Mon, 1 Nov 2010 11:55:53 +0000 (GMT) Received: from mail.ukfsn.org ([83.161.120.155]) by localhost (smtp-filter.ukfsn.org [83.161.120.155]) (amavisd-new, port 10024) with ESMTP id qrU5N9MlDbTK for <nunezjerry@example.org>; Mon, 1 Nov 2010 11:55:52 +0000 (GMT) Received: from zoogz.gregorie.org (unknown [83.161.120.155]) by mail.ukfsn.org (Postfix) with ESMTP id E7B92DEC6D for <nunezjerry@example.org>; Mon, 1 Nov 2010 11:55:52 +0000 (GMT) Received: from [83.161.120.155] (zappa.gregorie.org [83.161.120.155]) by zoogz.gregorie.org (Postfix) with ESMTP id 7D4742AFE5 for <nunezjerry@example.org>; Mon, 1 Nov 2010 11:55:52 +0000 (GMT) Subject: Re: spamassassin - more children / faster scanning From: Martin Gregorie <nunezjerry@example.org> Reply-To: nunezjerry@example.org To: nunezjerry@example.org In-Reply-To: <nunezjerry@example.org> References: <nunezjerry@example.org> Content-Type: text/plain; charset="UTF-8" Organization: Martin Gregorie Date: Mon, 01 Nov 2010 11:55:52 +0000 Message-ID: <nunezjerry@example.org> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 (2.28.3-1.fc12) Content-Transfer-Encoding: 7bit On Mon, 2010-11-01 at 04:59 +0000, Russ Sanders wrote: > I have an Ubuntu Linux server running SpamAssassin Server version 3.2.4 running > on Perl 5.8.8 with zlib support (Compress888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4Zlib 2.008). I have at least one > account that is having to process from 250 - 400 emails, 99% spam, per HOUR. > This works out to be approximately 8,000 emails per day. The spamassassin just > can't keep up and it is backing the Queue upto 2500 messages. I have made an > adjustment so that the one user can have multiple spamd children running for it, > but it doesn't seem to take on more that 2 spamd children. > You might also consider implementing greylisting on your MTA. When my ISP did so the spam volume dropped immediately from 80% of the mail I was receiving to between 4% and 8%. I run my own copy of SA. The CPU overheads of greylisting are much lower than those of SA. Martin From users-returnnunezjerry@example.org Mon Nov 01 13:17:17 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 69478 invoked from network); 1 Nov 2010 13:17:17 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 13:17:17 -0000 Received: (qmail 85753 invoked by uid 500); 1 Nov 2010 13:17:45 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 85512 invoked by uid 500); 1 Nov 2010 13:17:43 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 85505 invoked by uid 99); 1 Nov 2010 13:17:42 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 13:17:42 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=RCVD_IN_DNSWL_NONE,SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO ga.impsec.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 13:17:37 +0000 Received: from mercury.impsec.org (localhost [83.161.120.155]) by ga.impsec.org (8.13.7/8.13.7) with ESMTP id oA1DHF4d021264 for <nunezjerry@example.org>; Mon, 1 Nov 2010 06:17:15 -0700 Received: from mercury.impsec.org (tunnel.ga.impsec.org [83.161.120.155]) by mercury.impsec.org (8.14.4/8.14.0) with ESMTP id oA1DHEDW032109 for <nunezjerry@example.org>; Mon, 1 Nov 2010 06:17:14 -0700 Received: from localhost (jhardin@localhost) by mercury.impsec.org (8.14.4/8.14.4/Submit) with ESMTP id oA1DHElj032106 for <nunezjerry@example.org>; Mon, 1 Nov 2010 06:17:14 -0700 X-Authentication-Warning: mercury.impsec.org: jhardin owned process doing -bs Date: Mon, 1 Nov 2010 06:17:14 -0700 (PDT) From: John Hardin <nunezjerry@example.org> To: nunezjerry@example.org Subject: Re: spamassassin - more children / faster scanning In-Reply-To: <nunezjerry@example.org> Message-ID: <nunezjerry@example.org> References: <nunezjerry@example.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Mon, 1 Nov 2010, Russ Sanders wrote: > The system is a basic Linode running Ubuntu Linux 8.04 with 512M of memory. Any way to add more RAM? > Suggestions will be appreciated. You want to do things at SMTP time to reduce your email volume. Greylisting has been suggested; I see good results from it here. Rejecting messages that do not have a FDQN in the HELO string works well for me, too. I use milter-regex for this as well as for some other tests. Are you open to SMTP-time reject based on the Zen DNSBL? -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ nunezjerry@example.org FALaholic #11174 pgpk -a nunezjerry@example.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never does quite what I want. I wish Christopher Robin was here." -- Peter da Silva in a.s.r ----------------------------------------------------------------------- 6 days until Daylight Saving Time ends in U.S. - Fall Back From users-returnnunezjerry@example.org Mon Nov 01 14:15:21 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 98055 invoked from network); 1 Nov 2010 14:15:21 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 14:15:21 -0000 Received: (qmail 48154 invoked by uid 500); 1 Nov 2010 14:15:49 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 48065 invoked by uid 500); 1 Nov 2010 14:15:49 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 48058 invoked by uid 99); 1 Nov 2010 14:15:48 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 14:15:48 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO bnofimage1.buc.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with SMTP; Mon, 01 Nov 2010 14:15:40 +0000 Received: from bucmail.buc.com ([83.161.120.155]) by bnofimage1.buc.com (SAVSMTP 83.161.120.155) with SMTP id M2010110109151803232 for <nunezjerry@example.org>; Mon, 01 Nov 2010 09:15:18 -0500 Received: from [83.161.120.155] ([888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4.161.120.155]) (AUTH: LOGIN nunezjerry@example.org, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by bucmail.buc.com with esmtp; Mon, 01 Nov 2010 10:15:17 -0400 id 000F0082.4CCECB75.000048EE Message-ID: <nunezjerry@example.org> Date: Mon, 01 Nov 2010 10:15:16 -0400 From: Bowie Bailey <nunezjerry@example.org> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:83.161.120.155) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: nunezjerry@example.org Subject: Re: spamassassin - more children / faster scanning References: <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked by ClamAV on apache.org On 11/1/2010 12:59 AM, Russ Sanders wrote: > I have an Ubuntu Linux server running SpamAssassin Server version 3.2.4 running > on Perl 5.8.8 with zlib support (Compress888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4Zlib 2.008). I have at least one > account that is having to process from 250 - 400 emails, 99% spam, per HOUR. > This works out to be approximately 8,000 emails per day. The spamassassin just > can't keep up and it is backing the Queue upto 2500 messages. I have made an > adjustment so that the one user can have multiple spamd children running for it, > but it doesn't seem to take on more that 2 spamd children. > > I have also recorded that scanning a single message appears to take > approximately 15 seconds. I have adjusted the timeout to 5 seconds, but it > still appears to be taking 12 - 20 second per message. This works out to 4 per > minute, or 240 per hour. So, of course, it can't keep up if it has 450 per hour > nunezjerry@example.org. > > The system is a basic Linode running Ubuntu Linux 8.04 with 512M of memory. > I would like to adjust appropriately > > Number of Max Children > Number of Spare Children > Number of spamd services per account (upto max children if possible) > TimeOut on Scanning of the eMail > > Suggestions will be appreciated. Do you have any large 3rd party rulesets? If so, try removing them temporarily and see if it runs faster. Make sure you have a local caching DNS server to speed up blacklist queries. Check your memory usage. It sounds like you should have enough for 5 children, but it all depends on how much other stuff is running. If the system starts using swap, SA's performance takes a serious nosedive. If that is the case, either reduce the number of children or add memory. -- Bowie From users-returnnunezjerry@example.org Mon Nov 01 14:28:52 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 2520 invoked from network); 1 Nov 2010 14:28:52 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 14:28:52 -0000 Received: (qmail 65120 invoked by uid 500); 1 Nov 2010 14:29:20 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 64806 invoked by uid 500); 1 Nov 2010 14:29:18 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 64799 invoked by uid 99); 1 Nov 2010 14:29:16 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 14:29:16 +0000 X-ASF-Spam-Status: No, hits=-0.7 required=10.0 tests=RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO mail0.albyny.inoc.net) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 14:29:09 +0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=inoc.net; h=Received:From:Subject:Date:To; b=QH3QBaYhW/eEv82+QtvkXvRW5UZ1CmhBzF5Gdwa6zQ0FD978dK/kThKNNf29v+RpwJ2PfCM5yqY7OrlDMqP9+aToz/npo816nSX3mO4mjKHQ70obWmueLGTO2LAQnOWqkYGPwIwEJYjpLeg14U4vVbLb15Jf8mMHNEJm6lA9L7A=; X-Default-Received-SPF: pass (skip=loggedin (res=PASS)); Received: from void.ops.inoc.net (vanguard.noc.albyny.inoc.net [83.161.120.155]) by mail0.albyny.inoc.net (build v10.9.27) with ESMTP id 4632360-1941382 for <nunezjerry@example.org>; Mon, 01 Nov 2010 14:28:48 +0000 From: Robert Blayzor <nunezjerry@example.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Subject: Bayes dbm sync/expire speedup suggestion Date: Mon, 1 Nov 2010 10:28:43 -0400 Message-Id: <nunezjerry@example.org> To: nunezjerry@example.org Mime-Version: 1.0 (Apple Message framework v1081) X-Mailer: Apple Mail (2.1081) X-Authenticated-User: nunezjerry@example.org X-Virus-Checked: Checked by ClamAV on apache.org For the past several months I have been trying to find a way to make = maintaining the SpamAssassin bayes database more effective on our SA = servers. We have several SA servers, all running bayes globally on the = server, not per user. Bayes generally does a good job but on a fairly busy server bayes can be = less effective based on how you set the database up to learn/expire, = etc. So far I've followed just about every suggestion on trying to = effectively maintain bayes, while bayes still works, it's not without = some major problems mainly the one being when large syncs happen, the = bayes token database can be locked out from other SA children for up to = 10 minutes per sync. Basically we have setup our servers for "learn to journal" and we sync = the journal to the main bayes database about once an hour. We've found = that this process can take 8 to 10 minutes, give or take. We recently moved the bayes database into a RAM disk to see if that = would help, and while reads/seeks have sped up considerably, sync has = not. Expire does not seem to be a problem. Correct me if I'm wrong, but when you have bayes_learn_to_journal = enabled and then you run a sync, sa-learn basically moves bayes_journal = to bayes_journal.old and then starts merging/adding tokens into = bayes_toks. When this happens, bayes_toks is locked for the entire time = until the sync completes. So that, for us means the bayes database is = locked for about 10 minutes an hour. Expires do not seem to run that = long. In fact, expires finish about a minute.. which is acceptable. Would it make more sense that when you do a learn_to_journal and a sync = to make a copy of the bayes_toks database, say to "bayes_toks.new" and = merge/add tokens from the journal to that? Then, once the sync is = complete you can lock and copy the .new to the current and continue. = This should only lockout the database from updates for only seconds (if = that) rather than locking it out during the entire learn/add process. I = assume an expire could actually use the same logic for those of us using = manually running expire/sync in cron and periodically rather than via = auto methods. Thoughts? I guess my thought is to keep a read only version of = bayes_toks at almost the whole time avoiding any lock contentions from = the database being synced/expired. Our current bayes config: use_bayes 1 bayes_auto_learn 1 bayes_auto_expire 0 bayes_learn_to_journal 1 bayes_journal_max_size 0 bayes_expiry_max_db_size 1000000 lock_method flock SA 3.3.1 on FreeBSD 6.4 Perl 5.10 --=20 Robert Blayzor INOC, LLC nunezjerry@example.org http://www.inoc.net/~rblayzor/ From users-returnnunezjerry@example.org Mon Nov 01 14:38:44 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 5564 invoked from network); 1 Nov 2010 14:38:44 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 14:38:44 -0000 Received: (qmail 85067 invoked by uid 500); 1 Nov 2010 14:39:12 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 84844 invoked by uid 500); 1 Nov 2010 14:39:12 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 84832 invoked by uid 99); 1 Nov 2010 14:39:11 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 14:39:11 +0000 X-ASF-Spam-Status: No, hits=-2.3 required=10.0 tests=RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO mx1.secnap.com.ionspam.net) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 14:39:04 +0000 Received: from mx1.secnap.com.ionspam.net (mx1.secnap.com.ionspam.net [83.161.120.155]) by mx1.secnap.com.ionspam.net (Postfix) with ESMTP id 92BB22B7C55 for <nunezjerry@example.org>; Mon, 1 Nov 2010 10:38:43 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=secnap.com; h= content-transfer-encoding:content-type:content-type:in-reply-to :references:subject:subject:mime-version:user-agent:from:from :date:date:message-id; s=dkim; t=1288622322; x=1290436722; bh=mU HyIG0EyguvmuQi9v/MrzSYQhaYkuTRHXmGHdgxBiQ=; b=i39/G0qR4ZIvid6T+v 2/fqhrYNfR5L2WIpU9Fl9+13JFwTwfRca97XQeaXG7b8+nkjcEiEaiSiGFikhQgT l1GCFTV21on8riwzXjiVsqMTH42S8NBJPfrigSIIZ8JQhXxgHxSsfTKlRre/DvHx w+a0Uiqqf0pgx26C8ODc6swDU= X-Amavis-Modified: Mail body modified (using disclaimer) - mx1.secnap.com.ionspam.net X-Virus-Scanned: SpammerTrap(r) VPS-1500 nunezjerry@example.org Received: from USBCTDC001.secnap.com (usbctdc001.secnap.com [83.161.120.155]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mx1.secnap.com.ionspam.net (Postfix) with ESMTPS id D038E2B7C09 for <nunezjerry@example.org>; Mon, 1 Nov 2010 10:38:42 -0400 (EDT) Received: from macintosh.secnap.com (83.161.120.155) by USBCTDC001.secnap.com (83.161.120.155) with Microsoft SMTP Server (TLS) id 14.0.702.0; Mon, 1 Nov 2010 10:38:42 -0400 Message-ID: <nunezjerry@example.org> Date: Mon, 1 Nov 2010 10:38:42 -0400 From: Michael Scheidell <nunezjerry@example.org> User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:83.161.120.155) Gecko/20101027 Thunderbird/3.1.6 MIME-Version: 1.0 To: <nunezjerry@example.org> Subject: Re: Bayes dbm sync/expire speedup suggestion References: <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked by ClamAV on apache.org On 11/1/10 10:28 AM, Robert Blayzor wrote: > lock_method flock > Switch to the special mysql bayes. it will also allow you to expire based on time (with some added table). sync is dynamic but don't forget the cronjob to expire bayes daily. -- Michael Scheidell, CTO o: 602.971.5981 d: 602.971.5981 ISN: 1259*1300 >*| *SECNAP Network Security Corporation * Certified SNORT Integrator * 2008-9 Hot Company Award Winner, World Executive Alliance * Five-Star Partner Program 2009, VARBusiness * Best in Email Security,2010: Network Products Guide * King of Spam Filters, SC Magazine 2008 ______________________________________________________________________ This email has been scanned and certified safe by SpammerTrap(r). For Information please see http://www.secnap.com/products/spammertrap/ ______________________________________________________________________ From users-returnnunezjerry@example.org Mon Nov 01 16:48:49 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 93476 invoked from network); 1 Nov 2010 16:48:49 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 16:48:49 -0000 Received: (qmail 93310 invoked by uid 500); 1 Nov 2010 16:49:17 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 93264 invoked by uid 500); 1 Nov 2010 16:49:16 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 93257 invoked by uid 99); 1 Nov 2010 16:49:16 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 16:49:16 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO ulysses.noc.ntua.gr) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 16:49:08 +0000 Received: from theseas.softlab.ece.ntua.gr (theseas.softlab.ece.ntua.gr [83.161.120.155]) by ulysses.noc.ntua.gr (8.14.4/8.14.4) with ESMTP id oA1Gmhma063991 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 1 Nov 2010 18:48:43 +0200 (EET) (envelope-from nunezjerry@example.org) Received: from infinity.deepcore.ngn (athedsl-232686.home.otenet.gr [83.161.120.155]) (authenticated bits=0) by theseas.softlab.ece.ntua.gr (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id oA1GmfR4026522 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 1 Nov 2010 18:48:42 +0200 Received: from infinity.deepcore.ngn (localhost [83.161.120.155]) by infinity.deepcore.ngn (8.14.2/8.14.2) with ESMTP id oA1Gm3Bw014205; Mon, 1 Nov 2010 18:48:03 +0200 Received: from localhost (sysop@localhost) by infinity.deepcore.ngn (8.14.2/8.14.2/Submit) with ESMTP id oA1Gm2hV014198; Mon, 1 Nov 2010 18:48:03 +0200 Date: Mon, 1 Nov 2010 18:48:02 +0200 (EET) From: "Theodoros V. Kalamatianos" <nunezjerry@example.org> To: Russ Sanders <nunezjerry@example.org> cc: nunezjerry@example.org Subject: Re: spamassassin - more children / faster scanning In-Reply-To: <nunezjerry@example.org> Message-ID: <nunezjerry@example.org> References: <nunezjerry@example.org> User-Agent: Alpine 1.10 (LMD 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII X-Spam-Level: * X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on theseas.softlab.ece.ntua.gr X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.6 (ulysses.noc.ntua.gr [83.161.120.155]); Mon, 01 Nov 2010 18:48:43 +0200 (EET) X-Virus-Scanned: clamav-milter nunezjerry@example.org X-Virus-Status: Clean X-Old-Spam-Status: No, score=1.2 required=5.0 tests=RCVD_IN_PBL,SPF_SOFTFAIL autolearn=no version=3.2.5 On Mon, 1 Nov 2010, Russ Sanders wrote: > I have an Ubuntu Linux server running SpamAssassin Server version 3.2.4 running > on Perl 5.8.8 with zlib support (Compress888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4Zlib 2.008). I have at least one > account that is having to process from 250 - 400 emails, 99% spam, per HOUR. > This works out to be approximately 8,000 emails per day. The spamassassin just > can't keep up and it is backing the Queue upto 2500 messages. I have made an > adjustment so that the one user can have multiple spamd children running for it, > but it doesn't seem to take on more that 2 spamd children. > > I have also recorded that scanning a single message appears to take > approximately 15 seconds. I have adjusted the timeout to 5 seconds, but it > still appears to be taking 12 - 20 second per message. This works out to 4 per > minute, or 240 per hour. So, of course, it can't keep up if it has 450 per hour > nunezjerry@example.org. You keep mentioning SA throughput statistics, but you do not mention at all how your server fares load-wise. If your CPU(s) is(are) at 100% or your system is swapping a lot then simply raising the number of SA processes will not really help. > The system is a basic Linode running Ubuntu Linux 8.04 with 512M of memory. As already proposed, I'd definitely try to raise the system memory. What is your hardware setup? How does the load on this system look like? Does it have any other load apart from mail/SA? What about your network connection? A saturated Internet connection would also slow down blacklist queries a lot. Any other obvious bottlenecks, such as disk I/O to your mboxes ? Some details about your SA setup would also help. How is it attached to your mail system? Any non-default settings? Are you using Amavis? Any 3rd party/custom rulesets? What do your messages look like? If you are having SA scan a lot of 30MB messages you would definitely notice some performance issues. Are you using sa-compile to produce native code for the ruleset? As mentioned by other people you should also check your DNS system. Some braindead routers and ISPs impose a hard limit on DNS queries. Some BLs also limit the number of hits/hour for each IP unless you purchase a commercial service plan from them. Are you using a caching DNS server, as in http://wiki.apache.org/spamassassin/CachingNameserver? If you are not then the DNS queries themselves could slow processing down to a halt. > I would like to adjust appropriately > > Number of Max Children > Number of Spare Children > Number of spamd services per account (upto max children if possible) > TimeOut on Scanning of the eMail > > Suggestions will be appreciated. > > Thank You > Russ Regards, Theodoros Kalamatianos From users-returnnunezjerry@example.org Mon Nov 01 17:54:50 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 87391 invoked from network); 1 Nov 2010 17:54:50 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 17:54:50 -0000 Received: (qmail 12625 invoked by uid 500); 1 Nov 2010 17:55:18 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 12586 invoked by uid 500); 1 Nov 2010 17:55:18 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 12579 invoked by uid 99); 1 Nov 2010 17:55:18 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 17:55:18 +0000 X-ASF-Spam-Status: No, hits=-0.1 required=10.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO mx1.secnap.com.ionspam.net) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 17:55:11 +0000 Received: from mx1.secnap.com.ionspam.net (mx1.secnap.com.ionspam.net [83.161.120.155]) by mx1.secnap.com.ionspam.net (Postfix) with ESMTP id ADC462B7C8C; Mon, 1 Nov 2010 13:54:50 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=secnap.com; h= content-type:content-type:in-reply-to:references:subject:subject :mime-version:user-agent:from:from:date:date:message-id; s=dkim; t=1288634089; x=1290448489; bh=83lqgXuMqJEjz6BEhq51aeAiDHWM9KmN 6BwMg5jCRxA=; b=Biy1FnPsVf1dsZrxefWL9S+jtU8IZmdYfIqnfwdb5CA+47s3 Vie/Kb4A6uhFPCOLQwaTbatZ9G7UwnNcbus8sTtoPWHE5Hcg0HIH6LnFYQ0N2XIH hYgbTXlOctqXnH68SJ4c2daL/AxIlgEpqqV5BjGIydZbORurkl8gxAlxM8g= X-Amavis-Modified: Mail body modified (using disclaimer) - mx1.secnap.com.ionspam.net X-Virus-Scanned: SpammerTrap(r) VPS-1500 nunezjerry@example.org Received: from USBCTDC001.secnap.com (usbctdc001.secnap.com [83.161.120.155]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mx1.secnap.com.ionspam.net (Postfix) with ESMTPS id CC1C32B7C5D; Mon, 1 Nov 2010 13:54:49 -0400 (EDT) Received: from macintosh.secnap.com (83.161.120.155) by USBCTDC001.secnap.com (83.161.120.155) with Microsoft SMTP Server (TLS) id 14.0.702.0; Mon, 1 Nov 2010 13:54:49 -0400 Message-ID: <nunezjerry@example.org> Date: Mon, 1 Nov 2010 13:54:49 -0400 From: Michael Scheidell <nunezjerry@example.org> User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:83.161.120.155) Gecko/20101027 Thunderbird/3.1.6 MIME-Version: 1.0 To: Robert Blayzor <nunezjerry@example.org> CC: <nunezjerry@example.org> Subject: Re: Bayes dbm sync/expire speedup suggestion References: <nunezjerry@example.org> <nunezjerry@example.org> <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> Content-Type: multipart/alternative; boundary="------------030905090601060900050808" X-Virus-Checked: Checked by ClamAV on apache.org --------------030905090601060900050808 Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit On 11/1/10 1:52 PM, Robert Blayzor wrote: > On Nov 1, 2010, at 10:38 AM, Michael Scheidell wrote: >> Switch to the special mysql bayes. it will also allow you to expire based on time (with some added table). >> sync is dynamic but don't forget the cronjob to expire bayes daily. > > Unfortunately mysql is not an option in our setup, and running a standalone instance of mysql on the server itself just to serve bayes seems like a lot of additional overhead. > then you will probably always have delays. -- Michael Scheidell, CTO o: 602.971.5981 d: 602.971.5981 ISN: 1259*1300 >*| *SECNAP Network Security Corporation * Certified SNORT Integrator * 2008-9 Hot Company Award Winner, World Executive Alliance * Five-Star Partner Program 2009, VARBusiness * Best in Email Security,2010: Network Products Guide * King of Spam Filters, SC Magazine 2008 ______________________________________________________________________ This email has been scanned and certified safe by SpammerTrap(r). For Information please see http://www.secnap.com/products/spammertrap/ ______________________________________________________________________ --------------030905090601060900050808 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> <br> <br> On 11/1/10 1:52 PM, Robert Blayzor wrote: <blockquote cite="mid:nunezjerry@example.org" type="cite"> <pre wrap="">On Nov 1, 2010, at 10:38 AM, Michael Scheidell wrote: </pre> <blockquote type="cite"> <pre wrap="">Switch to the special mysql bayes. it will also allow you to expire based on time (with some added table). sync is dynamic but don't forget the cronjob to expire bayes daily. </pre> </blockquote> <pre wrap=""> Unfortunately mysql is not an option in our setup, and running a standalone instance of mysql on the server itself just to serve bayes seems like a lot of additional overhead. </pre> </blockquote> then you will probably always have delays.<br> <br> <br> <div class="moz-signature">-- <br> Michael Scheidell, CTO<br> o: 602.971.5981<br> d: 602.971.5981<br> ISN: 1259*1300<br> <font color="#999999">&gt;</font><font color="#cc0000"> <b>| </b></font>SECNAP Network Security Corporation <style type="text/css"> <!-- .unnamed1 { margin: 1em; padding: 1px; } --> </style> <ul class="unnamed1"> <li>Certified SNORT Integrator</li> <li>2008-9 Hot Company Award Winner, World Executive Alliance</li> <li>Five-Star Partner Program 2009, VARBusiness</li> <li>Best in Email Security,2010: Network Products Guide</li> <li>King of Spam Filters, SC Magazine 2008</li> </ul> </div> <br> <div id="disclaimer.secnap.com"><hr /> <p>This email has been scanned and certified safe by SpammerTrap&reg;. <br />For Information please see <a href="http://www.secnap.com/products/spammertrap/">http://www.secnap.com/products/spammertrap/</a></p> <hr /></div> <br> </body> </html> --------------030905090601060900050808-- From users-returnnunezjerry@example.org Mon Nov 01 18:00:24 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 89604 invoked from network); 1 Nov 2010 18:00:24 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 18:00:24 -0000 Received: (qmail 26173 invoked by uid 500); 1 Nov 2010 18:00:52 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 26145 invoked by uid 500); 1 Nov 2010 18:00:52 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 26138 invoked by uid 99); 1 Nov 2010 18:00:52 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:00:52 +0000 X-ASF-Spam-Status: No, hits=-0.7 required=10.0 tests=RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO mail1.albyny.inoc.net) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:00:45 +0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=inoc.net; h=Received:Subject:From:Date:To; b=Ezk5qnudFqUcoIylA4bAhjogcwCn/xezJxEvyZKmLw4ci2nzCRZVAZJ8iXQMjwvHHmeKDGmEICIgt+EA3wALchk56IosuhBzmcGArDpqZvCM0p1IVKZW3Q4Q3gzg3uWFa2QJPevtwRlz54Lizh1Vt8/vDB/VpMg0V1Z6GeNGWu8=; X-Default-Received-SPF: pass (skip=loggedin (res=PASS)); Received: from void.ops.inoc.net (vanguard.noc.albyny.inoc.net [83.161.120.155]) by mail1.albyny.inoc.net (build v10.9.27) with ESMTP id 4642790-1941382 for multiple; Mon, 01 Nov 2010 18:00:24 +0000 Subject: Re: Bayes dbm sync/expire speedup suggestion Mime-Version: 1.0 (Apple Message framework v1081) Content-Type: text/plain; charset=us-ascii From: Robert Blayzor <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> Date: Mon, 1 Nov 2010 14:00:13 -0400 Cc: <nunezjerry@example.org> Content-Transfer-Encoding: quoted-printable Message-Id: <nunezjerry@example.org> References: <nunezjerry@example.org> <nunezjerry@example.org> <nunezjerry@example.org> <nunezjerry@example.org> To: Michael Scheidell <nunezjerry@example.org> X-Mailer: Apple Mail (2.1081) X-Authenticated-User: nunezjerry@example.org X-Virus-Checked: Checked by ClamAV on apache.org On Nov 1, 2010, at 1:54 PM, Michael Scheidell wrote: > then you will probably always have delays. Hence my suggestion for making copies of the database to be worked on = during the sync/expire process. Then there should be virtually no delay = other than lock/copy which should be virtually seconds instead of = several minutes. --=20 Robert Blayzor INOC, LLC nunezjerry@example.org http://www.inoc.net/~rblayzor/ From users-returnnunezjerry@example.org Mon Nov 01 18:19:42 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 6777 invoked from network); 1 Nov 2010 18:19:42 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 18:19:42 -0000 Received: (qmail 52974 invoked by uid 500); 1 Nov 2010 18:20:11 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 52948 invoked by uid 500); 1 Nov 2010 18:20:10 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 52941 invoked by uid 99); 1 Nov 2010 18:20:10 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:20:10 +0000 X-ASF-Spam-Status: No, hits=0.7 required=10.0 tests=SPF_NEUTRAL X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [83.161.120.155] (HELO outbound.spamchek.net) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:20:03 +0000 Received: from mail.enidan.com (minerva.enidan.com [83.161.120.155]) by outbound.spamchek.net (Postfix) with ESMTPA id F3D1D565C4 for <nunezjerry@example.org>; Mon, 1 Nov 2010 19:20:06 +0100 (CET) Received: from news.jessen.ch (saturn.local.net [83.161.120.155]) by mail.enidan.com (Postfix) with ESMTP id ABEE66F025 for <nunezjerry@example.org>; Mon, 1 Nov 2010 19:19:29 +0100 (CET) Received: by news.jessen.ch (Postfix, from userid 65534) id 8DBC3D329E; Mon, 1 Nov 2010 19:19:29 +0100 (CET) X-Original-To: nunezjerry@example.org Delivered-To: nunezjerry@example.org Received: by news.jessen.ch (Postfix, from userid 9) id 7AA24D32FD; Mon, 1 Nov 2010 19:19:29 +0100 (CET) From: Per Jessen <nunezjerry@example.org> X-Newsgroups: list.mail.spamassassin.general Subject: Re: spamassassin - more children / faster scanning Date: Mon, 01 Nov 2010 19:19:29 +0100 Organization: Per Jessens personal news-server Lines: 20 Message-ID: <nunezjerry@example.org> References: <nunezjerry@example.org> <nunezjerry@example.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Trace: saturn.local.net 1288635569 14833 83.161.120.155 (1 Nov 2010 18:19:29 GMT) X-Complaints-To: nunezjerry@example.org User-Agent: KNode/0.10.4 To: nunezjerry@example.org Theodoros V. Kalamatianos wrote: > You keep mentioning SA throughput statistics, but you do not mention > at all how your server fares load-wise. If your CPU(s) is(are) at 100= % > or your system is swapping a lot then simply raising the number of SA= > processes will not really help. >=20 >> The system is a basic Linode running Ubuntu Linux 8.04 with 512M of >> memory. >=20 > As already proposed, I'd definitely try to raise the system memory. We have no data on the memory utilization on the OPs system, but two spamd instances in 512M leaves plenty of room. =20 /Per Jessen, Z=C3=BCrich From users-returnnunezjerry@example.org Mon Nov 01 18:28:18 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 15980 invoked from network); 1 Nov 2010 18:28:18 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 18:28:18 -0000 Received: (qmail 66267 invoked by uid 500); 1 Nov 2010 18:28:46 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 66236 invoked by uid 500); 1 Nov 2010 18:28:46 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 66229 invoked by uid 99); 1 Nov 2010 18:28:46 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:28:46 +0000 X-ASF-Spam-Status: No, hits=0.7 required=10.0 tests=SPF_NEUTRAL X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [83.161.120.155] (HELO dukecmmtar03.coxmail.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:28:38 +0000 Received: from dukecmimpo03.coxmail.com ([83.161.120.155]) by dukecmmtar03.coxmail.com (InterMail vM.83.161.120.155 201-2186-121-102-20070209) with ESMTP id <nunezjerry@example.org>; Mon, 1 Nov 2010 14:28:17 -0400 Received: from [83.161.120.155] ([83.161.120.155]) by dukecmimpo03.coxmail.com with bizsmtp id RuUG1f00J1nowU801uUGrG; Mon, 01 Nov 2010 14:28:17 -0400 Message-ID: <nunezjerry@example.org> Date: Mon, 01 Nov 2010 13:26:01 -0500 From: EACSI Support <nunezjerry@example.org> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Russ Sanders <nunezjerry@example.org> CC: nunezjerry@example.org Subject: Re: spamassassin - more children / faster scanning References: <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit I have had many helpful responses and I appreciate it. Some simple answers : The system is a "Linode 512" which is a virtual server hosted on a larger system of which I don't have the true specifications. Howerver, it runs as a 4 CPU/Core system with 512M of memory. I am looking at adding more memory to the linode to test as an option. The system itself runs very well, with the - CPU Idle status at 98% + - Disk I/O Wait at less than 5% - Free Memory at 60M (or roughly 10%) - The swap is commonly minimal using at between 0M and 50M of disk swap We are not using any third party rulesets, but thank you for the suggestion. We have the system to scan only eMails less than 256K (512K for some), so large emails are not the problem as they are ignored. The rest of the settings are pretty much a default, native installation with default settings. The messages are basic text messages, commonly - standard spam messages. The system commonly runs 2 to 3 connections to spamd with a maximum of 5, but when the email load gets high, it only seems to give two connections to spamd for the 1 user that is receiving the highest amount of eMail (8,000 per day). The problem is that the eMail does not come in regularly, of course. The system keeps up during the day, but during the evening, the system gets hammered with 3,000 emails during a 1 to 2 hour period. It can only process scanning on about 250 per hour per account. I would like to be able to have this one particular user have max number of spamd connections. And, if possible and effective, increase the max number of children to 8 - 10. I read up on processing at SMTP time & GreyListing and it sounds effective. I'll see about implementing some of those suggestions, including the Caching DNS Thank You for your advise. Russ From users-returnnunezjerry@example.org Mon Nov 01 18:34:30 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 18063 invoked from network); 1 Nov 2010 18:34:30 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 18:34:30 -0000 Received: (qmail 72912 invoked by uid 500); 1 Nov 2010 18:34:59 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 72886 invoked by uid 500); 1 Nov 2010 18:34:59 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 72879 invoked by uid 99); 1 Nov 2010 18:34:59 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:34:59 +0000 X-ASF-Spam-Status: No, hits=0.7 required=10.0 tests=SPF_NEUTRAL X-Spam-Check-By: apache.org Received-SPF: neutral (nike.apache.org: 83.161.120.155 is neither permitted nor denied by domain of nunezjerry@example.org) Received: from [83.161.120.155] (HELO smtp2.vianet.ca) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:34:50 +0000 Received: from [83.161.120.155] (pem-goatfarm.vianet.ca [83.161.120.155]) by smtp2.vianet.ca (Postfix) with ESMTP id D1B6B15B857 for <nunezjerry@example.org>; Mon, 1 Nov 2010 14:34:28 -0400 (EDT) Message-ID: <nunezjerry@example.org> Date: Mon, 01 Nov 2010 14:34:28 -0400 From: Kris Deugau <nunezjerry@example.org> Organization: ViaNet Internet Solutions User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:83.161.120.155eol) Gecko/20101020 CentOS/1.0.9-64.el4.centos SeaMonkey/1.0.9 MIME-Version: 1.0 To: nunezjerry@example.org Subject: Re: Rule works in testing, but not hitting live mail References: <nunezjerry@example.org> <nunezjerry@example.org> <nunezjerry@example.org> <nunezjerry@example.org> <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> Mail-Followup-To: nunezjerry@example.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked by ClamAV on apache.org NFN Smith wrote: > Lawrence @ Rogers wrote: > >> Are you running it against an e-mail with a known match? Using >> spamassassin -D -t sample-spam.txt and having sample-spam.txt contain >> the complete e-mail including headers? > > Yes, it's a known match. I can take a full copy of a received message > (with headers, although my servers strip Received: headers of inbound > messages before they're written to mailboxes). I have to ask: Why? Maybe your header-munging is mangling the To:? > Thus, a message that > passes through a server where the rule is included in production > configurations will show plenty of hits on other SpamAssassin rules > (including ones I've added myself), but not this particular rule. From > there, I can take the same message, and pipe through spamassassin -D -t > (using the same config file), I do get a hit on the rule. .. or not, if your call to SA in production is after the header-munging, but passing the message file through SA manually works OK. Check your manual test configuration *very* carefully against the way you call SA in production; if a rule works <here> but not <there>, SA is treating that rule, or file full of rules, different for some reason. -kgd From users-returnnunezjerry@example.org Mon Nov 01 18:36:42 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 18929 invoked from network); 1 Nov 2010 18:36:42 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 18:36:42 -0000 Received: (qmail 78437 invoked by uid 500); 1 Nov 2010 18:37:11 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 78415 invoked by uid 500); 1 Nov 2010 18:37:11 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 78408 invoked by uid 99); 1 Nov 2010 18:37:11 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:37:11 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO bnofimage1.buc.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with SMTP; Mon, 01 Nov 2010 18:37:06 +0000 Received: from bucmail.buc.com ([83.161.120.155]) by bnofimage1.buc.com (SAVSMTP 83.161.120.155) with SMTP id M2010110113364403278 for <nunezjerry@example.org>; Mon, 01 Nov 2010 13:36:44 -0500 Received: from [83.161.120.155] ([888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4.161.120.155]) (AUTH: LOGIN nunezjerry@example.org, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by bucmail.buc.com with esmtp; Mon, 01 Nov 2010 14:36:44 -0400 id 000F0082.4CCF08BC.0000502C Message-ID: <nunezjerry@example.org> Date: Mon, 01 Nov 2010 14:36:42 -0400 From: Bowie Bailey <nunezjerry@example.org> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:83.161.120.155) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: nunezjerry@example.org Subject: Re: spamassassin - more children / faster scanning References: <nunezjerry@example.org> <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit On 11/1/2010 2:26 PM, EACSI Support wrote: > > I read up on processing at SMTP time & GreyListing and it sounds > effective. If you are not already doing so, I would highly recommend using the zen.spamhaus.org blacklist at the SMTP level. It will block a large chunk of spam before SA even has to nunezjerry@example.org. -- Bowie From users-returnnunezjerry@example.org Mon Nov 01 18:48:11 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 20693 invoked from network); 1 Nov 2010 18:48:11 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 18:48:11 -0000 Received: (qmail 89193 invoked by uid 500); 1 Nov 2010 18:48:39 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 89122 invoked by uid 500); 1 Nov 2010 18:48:39 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 89115 invoked by uid 99); 1 Nov 2010 18:48:39 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:48:39 +0000 X-ASF-Spam-Status: No, hits=0.7 required=10.0 tests=SPF_NEUTRAL X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [83.161.120.155] (HELO outbound.spamchek.net) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 18:48:32 +0000 Received: from mail.enidan.com (minerva.enidan.com [83.161.120.155]) by outbound.spamchek.net (Postfix) with ESMTPA id 7B02974031 for <nunezjerry@example.org>; Mon, 1 Nov 2010 19:48:47 +0100 (CET) Received: from news.jessen.ch (saturn.local.net [83.161.120.155]) by mail.enidan.com (Postfix) with ESMTP id 665D0301CA for <nunezjerry@example.org>; Mon, 1 Nov 2010 19:48:10 +0100 (CET) Received: by news.jessen.ch (Postfix, from userid 65534) id 4833852CD1; Mon, 1 Nov 2010 19:48:10 +0100 (CET) X-Original-To: nunezjerry@example.org Delivered-To: nunezjerry@example.org Received: by news.jessen.ch (Postfix, from userid 9) id 3A69052CDA; Mon, 1 Nov 2010 19:48:10 +0100 (CET) From: Per Jessen <nunezjerry@example.org> X-Newsgroups: list.mail.spamassassin.general Subject: Re: spamassassin - more children / faster scanning Date: Mon, 01 Nov 2010 19:48:10 +0100 Organization: Per Jessens personal news-server Lines: 27 Message-ID: <nunezjerry@example.org> References: <nunezjerry@example.org> <nunezjerry@example.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Trace: saturn.local.net 1288637290 14999 83.161.120.155 (1 Nov 2010 18:48:10 GMT) X-Complaints-To: nunezjerry@example.org User-Agent: KNode/0.10.4 To: nunezjerry@example.org EACSI Support wrote: > The system commonly runs 2 to 3 connections to spamd with a maximum o= f > 5, but when the email load gets high, it only seems to give two > connections to spamd for the 1 user that is receiving the highest > amount of eMail (8,000 per day). >=20 > The problem is that the eMail does not come in regularly, of course.=20= > The system keeps up during the day, but during the evening, the syste= m > gets hammered with 3,000 emails during a 1 to 2 hour period. It can > only process scanning on about 250 per hour per account. >=20 > I would like to be able to have this one particular user have max > number of spamd connections. And, if possible and effective, increas= e > the max number of children to 8 - 10. 10 children on 512M is probably a little much, my spamd instances have = a footprint of about 60Mb each. /Per Jessen, Z=C3=BCrich From users-returnnunezjerry@example.org Mon Nov 01 19:10:49 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 38296 invoked from network); 1 Nov 2010 19:10:49 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 19:10:49 -0000 Received: (qmail 16738 invoked by uid 500); 1 Nov 2010 19:11:17 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 16719 invoked by uid 500); 1 Nov 2010 19:11:17 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 16712 invoked by uid 99); 1 Nov 2010 19:11:17 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 19:11:17 +0000 X-ASF-Spam-Status: No, hits=-0.7 required=10.0 tests=RCVD_IN_DNSWL_LOW,SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of nunezjerry@example.org designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO quad.pendre.co.uk) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 19:11:11 +0000 Received: from localhost (Quad [83.161.120.155]) by quad.pendre.co.uk (Postfix) with ESMTP id CDF762F46C7 for <nunezjerry@example.org>; Mon, 1 Nov 2010 19:10:48 +0000 (GMT) X-Virus-Scanned: nunezjerry@example.org Received: from quad.pendre.co.uk ([83.161.120.155]) by localhost (quad.pendre.co.uk [83.161.120.155]) (amavisd-new, port 10024) with LMTP id GCi-0zyu9zb1; Mon, 1 Nov 2010 19:10:48 +0000 (GMT) Received: from [83.161.120.155] (pendre.co.uk [83.161.120.155]) by quad.pendre.co.uk (Postfix) with ESMTP id 6FAE22F46C4 for <nunezjerry@example.org>; Mon, 1 Nov 2010 19:10:48 +0000 (GMT) Message-ID: <nunezjerry@example.org> Date: Mon, 01 Nov 2010 19:10:48 +0000 From: Ned Slider <nunezjerry@example.org> User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:83.161.120.155) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: nunezjerry@example.org Subject: Re: spamassassin - more children / faster scanning References: <nunezjerry@example.org> <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit On 01/11/10 13:17, John Hardin wrote: > On Mon, 1 Nov 2010, Russ Sanders wrote: > >> Suggestions will be appreciated. > > You want to do things at SMTP time to reduce your email volume. > > Greylisting has been suggested; I see good results from it here. > > Rejecting messages that do not have a FDQN in the HELO string works well > for me, too. I use milter-regex for this as well as for some other tests. > > Are you open to SMTP-time reject based on the Zen DNSBL? > Absolutely. The 3 measures outlined by John above will massively reduce the load (number of spam) that SpamAssassin (SA) gets to see. If you can tell us your MTA (postfix, sendmail, exim etc?) then I'm sure someone on the list will be able to point you in the right direction for implementing the above measures. With the above measures in place, I'd estimate my SA installation sees around 10 spam for every 1,000 spam sent - 990 get rejected at the smtp stage before SA. From users-returnnunezjerry@example.org Mon Nov 01 19:14:58 2010 Return-Path: <users-returnnunezjerry@example.org> Delivered-To: nunezjerry@example.org Received: (qmail 39565 invoked from network); 1 Nov 2010 19:14:58 -0000 Received: from unknown (HELO mail.apache.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Nov 2010 19:14:58 -0000 Received: (qmail 20736 invoked by uid 500); 1 Nov 2010 19:15:26 -0000 Delivered-To: nunezjerry@example.org Received: (qmail 20710 invoked by uid 500); 1 Nov 2010 19:15:26 -0000 Mailing-List: contact nunezjerry@example.org; run by ezmlm Precedence: bulk list-help: <mailto:nunezjerry@example.org> list-unsubscribe: <mailto:nunezjerry@example.org> List-Post: <mailto:nunezjerry@example.org> List-Id: <users.spamassassin.apache.org> Delivered-To: mailing list nunezjerry@example.org Received: (qmail 20703 invoked by uid 99); 1 Nov 2010 19:15:26 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 19:15:26 +0000 X-ASF-Spam-Status: No, hits=0.7 required=10.0 tests=SPF_NEUTRAL X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [83.161.120.155] (HELO dukecmmtar03.coxmail.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 19:15:18 +0000 Received: from dukecmimpo02.coxmail.com ([83.161.120.155]) by dukecmmtar03.coxmail.com (InterMail vM.83.161.120.155 201-2186-121-102-20070209) with ESMTP id <nunezjerry@example.org> for <nunezjerry@example.org>; Mon, 1 Nov 2010 15:14:57 -0400 Received: from [83.161.120.155] ([83.161.120.155]) by dukecmimpo02.coxmail.com with bizsmtp id RvEx1f0061nowU801vExjp; Mon, 01 Nov 2010 15:14:57 -0400 Message-ID: <nunezjerry@example.org> Date: Mon, 01 Nov 2010 14:12:41 -0500 From: EACSI Support <nunezjerry@example.org> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 To: nunezjerry@example.org Subject: Re: spamassassin - more children / faster scanning References: <nunezjerry@example.org> <nunezjerry@example.org> <nunezjerry@example.org> In-Reply-To: <nunezjerry@example.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit That sound great! We are using PostFix Thank You Russ Ned Slider wrote: > On 01/11/10 13:17, John Hardin wrote: > >> On
{'source': 'Apache Software Foundation Public Mail Archives'}