A couple of questions regarding MailScanner

[Martin Hepworth]

Jason

see inline

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Jason Williams wrote:
> Hello everyone.
>
> I have a few questions that I wanted to ask, regarding MS and my setup. So
> far, everything has been working well. I am continuing to monitor, tweak
> and tune my server each day. Work in progress. Here are a few questions
> that I have been thinking about lately.
>
>
> Question 1.) Cleaning out the quarantine directory....how aften?
>
> As it states, what is the recommendation for cleaning out all of the
> quarantined items that MS has stored? I should mention that I am running
> MailWatch and I have set it up to store all emails that are tagged as spam.
>
> While there is spam in there, i'm assuming that I can train the engine to
> learn from the quarantined spam. Probably use sa-learn first from the
> stored spam, then clean out the quarantine?
>

I use Julians clean_quarantine script. It was only with the RPM's but I
think with the 4.30 release he's started distibuting all the scripts
with the tar.gz format as well.

I keep 30 days online.

>
>
> Question 2.) bayes engine....best way to train it?
>
> Continuation of question one. Being as I have probably around 300 pieces of
> spam in there, is there a preferred method to train spam for MS? I've seen
> and read different ways people use sa-learn for different systems. Wanted
> to know if there was preferred method to use in conjunction with MS.
>
>

seems to vary - depends on what facilities you have. I run imap based
based do users simply drop corrections into a spam or ham folder and I
drag that out with a perl script (in the archives) and pump them into
sa-learn. The perl script runs as the mailscanner user defined in
MailScanner.con so the bayes permissions don't get stuffed.


>
> Question 3.) shutting down my machine...recommendations?
>
> I have to shutdown my machine this weekend, because we are moving our rack
> from one floor to another. I'm hoping it will only be down for about 20-30
> minutes. We shall see. Anyone have any recommendations on what I should do
> before I power down the server? I have the usual ideas such as backing up
> my config files, but anything else?
>

completely backup the server!!!! It's not just MS thats at risk..

>
>
> Question 4.) Spam emails coming in, that have .pif files attached.
>
> One thing I have noticed is that a lot of emails that are coming in and
> that are marked as SPAM, have .pif attachments. For the most part, these
> .pif attachments are probably viruses of some sort. I just find it kinda
> funny that they are being marked as SPAM. I have no problem with that but
> was curious if anyone else has similar things happening as well.
>

dunno - I virus scan and block pifs anyhow..

>
> Question 5.) What changes require MS to be restarted?
>
> Something I have thought about a lot recently. But, do you need to restart
> MS after any changes you make to any of the configuration files? Rules?
> .conf? etc. I'm assuming you do, but thought I would verify.
>

I restart on any config change. That way things happen straight away.

>

> That is about it for now.
>
> I appreciate the help.
> Jason
>
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> Before posting, please see the Most Asked Questions at
> http://www.mailscanner.biz/maq/     and the archives at
> http://www.jiscmail.ac.uk/lists/mailscanner.html

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html