Minimum hardware capacity for 35k e-mail scans/day

[Peter Peters]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Edward Prendergast wrote on 14-11-2007 17:16:

> By 5pm we've usually scanned 35,000 mails, 10% of that legitimate. We reject
> at MTA based on greet-pause and invalid recipients. We have tried to reduce
> the amount of users with catch-alls to the absolute minimum. We went on a
> Mail optimisation overhaul a few months ago during which time MailScanner's
> working area was switched to tempfs and we started using compiled rules. 

We are getting over 300.000 messages (single from's) a day. And we block
another 360.000 at the MTA level (60.000 without reverse DNS, 100.000
blocked consumernetwork, 30.000 non-excisting domains and the rest
non-excisting users). Only about 2000 messages are deleted by
MailScanner. The rest is delivered to the users.

We don't use tmpfs.
Our system is an HP dual core Intel(R) Xeon(TM) CPU 3.00GHz with 4GB of
memory runnig Sendmail, MailScanner, Spamassassin with bayes, F-prot and
ClamAV.

Before we started blocking on reverse DNS our incoming queue grew from
noon until midnight and it disappeared in 6 hours. With reverse DNS
blocking we don't see any raise in the incoming queue anymore.

The load was usually between 10 and 15. But is now between 4 and 10.

- --
Peter Peters, Teamleider Unix/Linux-Beheer
ICT-Servicecentrum
Universiteit Twente, Postbus 217, 7500 AE Enschede
Telefoon 053 489 2301, Fax 053 489 2383,
P.G.M.Peters at utwente.nl, http://www.utwente.nl/icts
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHPCNfelLo80lrIdIRAmMLAJsEhWzBxUTWGSk47BIo/jCJNQsmsgCeKyHS
xkqLIvt11d1hoob3ScP7q5w=
=FGlo
-----END PGP SIGNATURE-----