Too messages in Hold folder when spamassassin is activated in
MailScanner
UxBoD
uxbod at splatnix.net
Tue Nov 27 18:11:31 GMT 2007
Well ASN is hashed out in your v320 pre file but is still active in the v310 file. We process over 100k messages a day on a 256k line so no real worries there. You say a high percentage of your traffic is SMTP, how are you identifying that ? Are you performing any sort of packet shaping or QoS then ? It does sound to me like DNS timeouts when performing lookups, as others have also said. If you set the list of RBLs to check to blank in MailScanner.conf does the problem disappear ?
Regards,
--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net
----- Original Message -----
From: "Israel Garcia" <igalvarez at gmail.com>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Tuesday, November 27, 2007 4:50:20 PM (GMT) Europe/London
Subject: Re: Too messages in Hold folder when spamassassin is activated in MailScanner
On Nov 25, 2007 3:56 PM, Glenn Steen < glenn.steen at gmail.com > wrote:
On 25/11/2007, Israel Garcia < igalvarez at gmail.com > wrote:
> On Nov 25, 2007 2:46 PM, Glenn Steen < glenn.steen at gmail.com > wrote:
>
> >
> >
> >
> > On 25/11/2007, Israel Garcia < igalvarez at gmail.com > wrote:
> > > Hi all, I'm running MailScanner-4.65-3.1(with DCC, razor2, pyzor) on a
> > > CentOS4.5 Linux server. I installed too the package
> > > install-Clam-0.91.2-SA-3.2.3.tar.gz in order to
> activate spamassassin
> > > with mailscanner. I ran spamassassin -D --lint and there's no problem
> > > in my configuration files. I also see in maillog file the spamassassin
> > > doing its work with spam:
> > >
> > > Nov 25 04:54:51 hostname MailScanner[20611]: Message B25732B1DB.A9A63
> > > from MailScanner warning: numerical links are often malicious: 75.93.188.141 ( jerrimy at donin.com ) to mydomain.com is spam,
> > > SBL+XBL, spamcop.net , SpamAssassin (not cached, score=30.984, required
> > > 6, DCC_CHECK 1.37, FH_HELO_EQ_D_D_D_D 0.50, FS_REPLICA 1.18,
> > > HELO_DYNAMIC_IPADDR2 4.39, HTML_MESSAGE 0.00, RATWARE_MS_HASH 2.78,
> > > RATWARE_OUTLOOK_NONAME 0.00, RCVD_IN_BL_SPAMCOP_NET 2.19, RCVD_IN_XBL
> > > 2.90, RDNS_DYNAMIC 0.10 , SARE_SPEC_REPLICA_OBFU 1.81,
> > > SARE_SPEC_ROLEX_NOV5A 1.06, TVD_RCVD_IP 1.62, URIBL_AB_SURBL 1.61,
> > > URIBL_BLACK 1.96, URIBL_JP_SURBL 2.86, URIBL_OB_SURBL 2.13,
> > > URIBL_SC_SURBL 2.52)
> > >
> > > Everything is fine BUT, when I run "qshape hold" I see the HOLD folder
> > > is FULL of messages waiting to be processed, I mean thousands of mails
> > > waiting and there is a long delay in delivering.
> > > My link to internet is not full, I mean I see the normal traffic.
> > >
> > > So, when I turn off spamassassin in MailScanner.conf there's almost no
> > > messages in HOLD foder.
> > >
> > > My questions are:
> > >
> > > 1. How can I speed the spamassassin process in my server?
> > Use a caching only DNS, limit what you check (RBLs etc).... There are
> > some things to do:-)
> >
> >
>
> I have in this server a caching only DNS...
> >
> >
> > > 2. Do I have to use all the plugins (DCC, razor2, pyzor, spamcop, and
> > > others that comes activated by default when I install spamassassin
> > > package)?
> > No. But they all contribute something:-). WRT Pyzor, make sure you use
> > the "alternative" server, the official one will likely just time out.
> > What modules do you load?
>
> I use DCC, razor2, pyzor and all the stuff from /etc/mail/spamassassin
> config files:
>
> -rw-r--r-- 1 root root 1089 Jun 2 13:40 init.pre
> lrwxrwxrwx 1 root root 41 Jun 2 21:43 local.cf ->
> /etc/MailScanner/spam.assassin.prefs.conf
You shouldn't have local.cf as a link to spam.assassin.prefs.conf....
That was more a thing some did before the advent of the mailscanner.cf
link.
local.cf is a perfect place to have local rescoring etc ... Like
setting dead RBLs to score 0 (thus preventing a timeout problem), or
RBLs that might be ... problematic (like if you get firewalled by
spamhaus... Check recent threads on the list for a simple test to see
if you've been FW'd by them).
Glenn, sorry my delay in answers you but I was busy with this server... I dont really get what you mean by local.cf file.. should I delete the local.cf link?
> lrwxrwxrwx 1 root root 41 Nov 24 11:00 mailscanner.cf ->
> /etc/MailScanner/spam.assassin.prefs.conf
> drwxr-xr-x 3 root root 4096 Nov 24 15:43 old
> drwxr-xr-x 2 root root 4096 Nov 25 05:05 RulesDuJour
> drwx------ 2 root root 4096 Nov 25 05:08 sa-update-keys
> -rw-r--r-- 1 root root 2439 Jun 2 14:03 v310.pre
> -rw-r--r-- 1 root root 922 Jun 2 13:39 v312.pre
> -rw-r--r-- 1 root root 2299 Jun 2 13:40 v320.pre
I was more thinking along the lines of what loadmodule statements that
you have active:-). Check that ASN isn't loaded... for example:-).
If you like, paste result of
# grep -i loadplug /etc/mail/spamassassin/*.pre
Here you go:
[root at domain.com:/etc/yum.repos.d]$ grep -i loadplug /etc/mail/spamassassin/*.pre
/etc/mail/spamassassin/init.pre:# loadplugin Mail::SpamAssassin::Plugin::RelayCountry
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::Hashcash
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::ASN
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::DCC
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Pyzor
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::SpamCop
/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::AntiVirus
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::AWL
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold
/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::TextCat
/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::AccessDB
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::WhiteListSubject
/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::DomainKeys
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::ReplaceTags
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::ASN
/etc/mail/spamassassin/v312.pre:#loadplugin Mail::SpamAssassin::Plugin::DKIM
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Check
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIDetail
/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::Shortcircuit
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Bayes
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::BodyEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::DNSEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HTMLEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HeaderEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::MIMEEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::RelayEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::WLBLEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::VBounce
/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody
/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::ASN
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::ImageInfo
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::ASN
(snip)
> I'm running to read them NOW! :-)
Good. The message never received is the least loading...:-).
So, I have to tell you I'm having the same problem with a lot of messages in HOLD folder when I check mails with spamassassin.. I also note this things:
1. My link to Internet is FULL and high % is SMTP.
2. I see a laod average high load average: 9.92, 8.29, 7.21 (I have a compaq proliant with two CPUs and 2GB RAM)
3. I am processing almost 40000 email daily.is it high for this server with 256Kbps Frame relay connection?
thanks in advance
regards
Israel
>
> >
> >
> >
> > > 4. Does anybody knows some perfect setup (best perfomance) to install
> > > mailscanner with spamssassin? some link? some tutorial?
> > Perfect is too much to aim for;-). I usually try for functional:-):-)
>
> :-) :-) .. thanks a lot Glenn
:-)
Cheers
--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
--
Regards;
Israel Garcia
--
This message has been scanned for viruses and
dangerous content by MailScanner , and is
believed to be clean.
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the MailScanner
mailing list