DOS attacked :(

[Julian Field]

At 02:11 04/03/2004, you wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> > Behalf Of Pete
> > Sent: Wednesday, March 03, 2004 8:10 PM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: DOS attacked :(
> >
> > Kevin Spicer wrote:
> >
> > >Is update_virus_scanners running? If for some reason a scanner update
> > >hangs MailScanner will stop processing mail.  If this is the case please
> > >post which scanner is the problem so that timeout code can be added to
> > >its wrapper script.
> > >
> > >Is Spamassasin trying to use pyzor?  Make sure its not if it isn't
> > >working properly.
> > >
> > >Maybe turn SA off for a while to catch up?  Or just turn off all SA's
> > >network checks.
> > >
> > >Maybe the bayes database is causing a problem, try turning off bayes
> > >(turn off the bayes auto rebuild in MailScanner too if your version has
> > >it).
> > >
> > >
> > >
> > First thing i did was turn off bayes.
> > Yes virus update scaner is running, although i did see some deferred for
> > 600secs messages,
>
>This is normal with the latest versions of MailScanner. Julian added a delay
>so we wouldn't all hit the ClamAV servers at the top of the hour. You might
>want to change the delay in your update_virus_scanners so we don't all hit
>the servers at 600 seconds after the hour.

It delays the cron job by a random amount up to 600 seconds, not just 600
seconds every time. If you check the syslog message you will find it says this:
"Delaying cron job up to 600 seconds"
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654