spam getting through / ENSIM

[Andy Norris]

At 02:17 pm 2006-10-13, you wrote:
>Hi Andy,
>
>Thanks for getting on this issue. Perhaps together and with the help 
>of the gurus on this mailing list we can crack this problem.
>
>Andy Norris wrote:
>>If I stop sendmail, like I'm supposed to for MailScanner, 
>>MailScanner does, indeed, start the instances of sendmail that it 
>>needs for pushing the mail to the mailboxes. However, I cannot sent 
>>mail from my email client through the server, as there's no 
>>connection (nothing listening on port 25). So I have to be running 
>>sendmail, and MailScanner is only scanning the mail it gets around 
>>to before other sendmail processes deliver it without scanning.
>That's interesting. If I stop sendmail and MailScanner, then start 
>only MailScanner, I don't see anything that indicates that sendmail 
>has started up. Since it's a live server, I have to be particularly 
>careful about when I experiment with this stuff since we have 
>hundreds of users relying on this machine.


The only way I've detected that MailScanner is starting the process 
is by doing "service sendmail status"... and just repeating that 
command repeatedly after stopping sendmail and restarting 
MailScanner. It takes several seconds... maybe a minute, but then it 
does show sendmail running on one to four PIDs. However, once 
MailScanner is done processing the batch, those processes are dead, 
and none of them are listening for SMTP connections. Perhaps it's as 
easy as me learning how to start sendmail just to listen on port 25?? Dunno.


>>Also, when shutting down sendmail, the 
>>/home/virtual/FILESYSTEMTEMPLATE/services/sendmail/mqueue directory 
>>gets backed up with a lot of mail... then when starting sendmail 
>>again -- because I have to! -- it takes a lot of time to get that 
>>mail out the door. In fact, there is mail in that directory from a 
>>couple days ago, and I need to figure out how to get sendmail to 
>>deal with all that. Is that directory filling up for you, as well?
>The directory only fills up during peak times of the day for me, but 
>it eventually clears itself out. If you type "mailq" does it list 
>these stuck messages for you?

Yes, it does list them. One thing I JUST now did, though I'm not sure 
how much of a difference this will make... I edited 
/etc/sysconfig/sendmail and changed a line from QUEUE=1h to QUEUE=1m. 
The outgoing mail seems to be getting picked up quicker.

>At peak times of the day, it can take upwards of 20 minutes for a 
>message to go through our server; at other times it's less than 15 
>seconds. A couple of minutes is acceptable, but to me > 5 minutes is not.
>>Seems that just recently things have started going more haywire. 
>>Don't know if it's just that we're being pounded by spammers or what.
>I second that. About 6 weeks to a couple of months ago, we had no 
>issues. Peak times of day were only few minutes for email to go 
>through. We haven't changed anything. Not sure what's going on here.
>>It would be great if we could share anything we might find to get 
>>to where we need to be!
>I concur. In the years I've been on this mailing list, I have found 
>nothing but excellent information supplied by some of the top people 
>in their various industries. MailScanner has been, and continues to 
>be, the absolute pinnacle of what open source software and the 
>community that uses and supports it can be.


Yes, I do rely on this group quite a bit, and I hope that everyone on 
the group can tolerate a thread on trying to figure out how to get 
MailScanner running optimally on Ensim. I fault Julian and 
MailScanner not a bit in the problems I'm having. Ensim seems to be a 
black box in some areas, and this is not the first time I've been 
flustered. However, it comes down to the fact I have to use 
SOMEthing. And everything has its strengths and weaknesses.


>I am curious what might be different about your MailScanner.conf 
>file and mine. Why does yours start sendmail and mine doesn't...Can 
>you list the lines that start with "sendmail" from your conf file? 
>Also, what version of Ensim and MailScanner are you running? What do 
>you see when you type "service MailScanner start" (assuming it's 
>stopped)? Do you see any reference to sendmail?


I tell you what... I will send in a separate email to you my 
MailScanner.conf file if you will share yours with me. I would be 
interested in seeing the deltas. It's high time I clean mine up, too.

I'm running:

sendmail v8.12.11
RHEL ES v3 (Taroon update 4)
Perl v5.8.0
spamassassin v3.1.0
Ensim Pro 4.0.3-22.rhel.3ES


>Let's get this nut cracked and get back to the levels of spam 
>filtering we used to have.

Agreed! I'd like to get back to being an "expert" in the things I 
want to know / do... not the things that nobody else wants to tackle!

Andy


>Chris