MailScanner suddently taking all the CPU and a lot of memory.

[Yannick Cayer]

 My MTA is sendmail

I guess I could use some help in setting it up to block this...

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Kevin Spicer
> Sent: Monday, February 02, 2004 6:21 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: MailScanner suddently taking all the CPU and a
> lot of memory.
>
> On Mon, 2004-02-02 at 23:13, Yannick Cayer wrote:
> > > 'Since Last Week' - are you sure this isn't anything to
> do with the
> > > MyDoom outbreak and its associated bounce messages (the
> load on my
> > > production server doubled and it struggled to keep up at
> times).  If
> > > you're not already doing so I suggest taking steps to block
> > > subjects/ email addresses used by this virus at your MTA
> (sendmail
> > > rulesets have ben posted several times in the last week -
> search the
> > > archives for 'LOCAL RULESET')
> >
> > I guess I could set a rule with spamassassin to block the
> subjects....
> >
>
> That won't make much difference to the load on your system,
> you need to do it at the MTA, so that the mail is rejected at
> the rcpt or data stage of the SMTP transaction.  That will
> save your mail server the trouble of scanning it for viruses
> and spam and the hassle of attempting delivery to
> non-existent users/domains.  If you post which MTA you are
> using maybe someone could help.
>
> Have you established that this is what is causing your problem?   (If
> you don't have any monitoring in place even just doing a wc
> -l on your daily maillog over the last couple of weeks should
> give you a flavour of what your mail load is like.
>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact
> the sender and delete this message immediately.  Disclosure,
> copying or other action taken in respect of this email or in
> reliance on it is prohibited.  BMRB International Limited
> accepts no liability in relation to any personal emails, or
> content of any email which does not directly relate to our business.
>