Too messages in Hold folder when spamassassin is activated in
MailScanner
UxBoD
uxbod at splatnix.net
Tue Nov 27 21:01:26 GMT 2007
So when disabling RBLs the problem disappears. Thats a start! If your bandwidth is saturated then lookups are taking a long time. Is your Internet connection being over utilised ? Sorry not at machine to check the RBLs you are using.
Regards,
--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net
----- Original Message -----
From: "Israel Garcia" <igalvarez at gmail.com>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Tuesday, November 27, 2007 8:37:53 PM (GMT) Europe/London
Subject: Re: Too messages in Hold folder when spamassassin is activated in MailScanner
On Nov 27, 2007 1:11 PM, UxBoD < uxbod at splatnix.net > wrote:
Well ASN is hashed out in your v320 pre file but is still active in the v310 file.
What does it means?
We process over 100k messages a day on a 256k line so no real worries there. You say a high percentage of your traffic is SMTPr ba, how are you identifying that ?
I can see the traffic in my WAN network using a cisco router/netflow collector.
Are you performing any sort of packet shaping or QoS then ?
No
It does sound to me like DNS timeouts when performing lookups, as others have also said.
Well, I use a only caching dns (caching-nameserver-7.3-3)
If you set the list of RBLs to check to blank in MailScanner.conf does the problem disappear ?
Do you mean thie line:
Spam List = #ORDB-RBL SBL+XBL spamcop.net NJABL SORBS #
When the problem disappear is when I set:
Use Spamassassin = no
and restart mailscanner...
thanks in advance
Israel
Regards,
--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net
----- Original Message -----
From: "Israel Garcia" < igalvarez at gmail.com >
To: "MailScanner discussion" < mailscanner at lists.mailscanner.info >
Sent: Tuesday, November 27, 2007 4:50:20 PM (GMT) Europe/London
Subject: Re: Too messages in Hold folder when spamassassin is activated in MailScanner
On Nov 25, 2007 3:56 PM, Glenn Steen < glenn.steen at gmail.com > wrote:
On 25/11/2007, Israel Garcia < igalvarez at gmail.com > wrote:
> On Nov 25, 2007 2:46 PM, Glenn Steen < glenn.steen at gmail.com > wrote:
>
> >
> >
> >
> > On 25/11/2007, Israel Garcia < igalvarez at gmail.com > wrote:
> > > Hi all, I'm running MailScanner-4.65-3.1(with DCC, razor2, pyzor) on a
> > > CentOS4.5 Linux server. I installed too the package
> > > install-Clam-0.91.2-SA-3.2.3.tar.gz in order to
> activate spamassassin
> > > with mailscanner. I ran spamassassin -D --lint and there's no problem
> > > in my configuration files. I also see in maillog file the spamassassin
> > > doing its work with spam:
> > >
> > > Nov 25 04:54:51 hostname MailScanner[20611]: Message B25732B1DB.A9A63
> > > from MailScanner warning: numerical links are often malicious: MailScanner warning: numerical links are often malicious: 75.93.188.141 ( jerrimy at donin.com ) to mydomain.com is spam,
> > > SBL+XBL, spamcop.net , SpamAssassin (not cached, score=30.984, required
> > > 6, DCC_CHECK 1.37, FH_HELO_EQ_D_D_D_D 0.50, FS_REPLICA 1.18,
> > > HELO_DYNAMIC_IPADDR2 4.39, HTML_MESSAGE 0.00, RATWARE_MS_HASH 2.78,
> > > RATWARE_OUTLOOK_NONAME 0.00, RCVD_IN_BL_SPAMCOP_NET 2.19, RCVD_IN_XBL
> > > 2.90, RDNS_DYNAMIC 0.10 , SARE_SPEC_REPLICA_OBFU 1.81,
> > > SARE_SPEC_ROLEX_NOV5A 1.06, TVD_RCVD_IP 1.62, URIBL_AB_SURBL 1.61,
> > > URIBL_BLACK 1.96, URIBL_JP_SURBL 2.86, URIBL_OB_SURBL 2.13,
> > > URIBL_SC_SURBL 2.52)
> > >
> > > Everything is fine BUT, when I run "qshape hold" I see the HOLD folder
> > > is FULL of messages waiting to be processed, I mean thousands of mails
> > > waiting and there is a long delay in delivering.
> > > My link to internet is not full, I mean I see the normal traffic.
> > >
> > > So, when I turn off spamassassin in MailScanner.conf there's almost no
> > > messages in HOLD foder.
> > >
> > > My questions are:
> > >
> > > 1. How can I speed the spamassassin process in my server?
> > Use a caching only DNS, limit what you check (RBLs etc).... There are
> > some things to do:-)
> >
> >
>
> I have in this server a caching only DNS...
> >
> >
> > > 2. Do I have to use all the plugins (DCC, razor2, pyzor, spamcop, and
> > > others that comes activated by default when I install spamassassin
> > > package)?
> > No. But they all contribute something:-). WRT Pyzor, make sure you use
> > the "alternative" server, the official one will likely just time out.
> > What modules do you load?
>
> I use DCC, razor2, pyzor and all the stuff from /etc/mail/spamassassin
> config files:
>
> -rw-r--r-- 1 root root 1089 Jun 2 13:40 init.pre
> lrwxrwxrwx 1 root root 41 Jun 2 21:43 local.cf ->
> /etc/MailScanner/spam.assassin.prefs.conf
You shouldn't have local.cf as a link to spam.assassin.prefs.conf... .
That was more a thing some did before the advent of the mailscanner.cf
link.
local.cf is a perfect place to have local rescoring etc ... Like
setting dead RBLs to score 0 (thus preventing a timeout problem), or
RBLs that might be ... problematic (like if you get firewalled by
spamhaus... Check recent threads on the list for a simple test to see
if you've been FW'd by them).
Glenn, sorry my delay in answers you but I was busy with this server... I dont really get what you mean by local.cf file.. should I delete the local.cf link?
> lrwxrwxrwx 1 root root 41 Nov 24 11:00 mailscanner.cf ->
> /etc/MailScanner/spam.assassin.prefs.conf
> drwxr-xr-x 3 root root 4096 Nov 24 15:43 old
> drwxr-xr-x 2 root root 4096 Nov 25 05:05 RulesDuJour
> drwx------ 2 root root 4096 Nov 25 05:08 sa-update-keys
> -rw-r--r-- 1 root root 2439 Jun 2 14:03 v310.pre
> -rw-r--r-- 1 root root 922 Jun 2 13:39 v312.pre
> -rw-r--r-- 1 root root 2299 Jun 2 13:40 v320.pre
I was more thinking along the lines of what loadmodule statements that
you have active:-). Check that ASN isn't loaded... for example:-).
If you like, paste result of
# grep -i loadplug /etc/mail/spamassassin/*.pre
Here you go:
[root at domain.com:/etc/yum.repos.d]$ grep -i loadplug /etc/mail/spamassassin/*.pre
/etc/mail/spamassassin/init.pre:# loadplugin Mail::SpamAssassin::Plugin::RelayCountry
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::Hashcash
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::ASN
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::DCC
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Pyzor
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::SpamCop
/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::AntiVirus
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::AWL
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold
/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::TextCat
/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::AccessDB
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::WhiteListSubject
/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::DomainKeys
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::ReplaceTags
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::ASN
/etc/mail/spamassassin/v312.pre:#loadplugin Mail::SpamAssassin::Plugin::DKIM
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Check
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIDetail
/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::Shortcircuit
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Bayes
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::BodyEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::DNSEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HTMLEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HeaderEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::MIMEEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::RelayEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::WLBLEval
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::VBounce
/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody
/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::ASN
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::ImageInfo
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::ASN
(snip)
> I'm running to read them NOW! :-)
Good. The message never received is the least loading...:-).
So, I have to tell you I'm having the same problem with a lot of messages in HOLD folder when I check mails with spamassassin.. I also note this things:
1. My link to Internet is FULL and high % is SMTP.
2. I see a laod average high load average: 9.92, 8.29, 7.21 (I have a compaq proliant with two CPUs and 2GB RAM)
3. I am processing almost 40000 email daily.is it high for this server with 256Kbps Frame relay connection?
thanks in advance
regards
Israel
>
> >
> >
> >
> > > 4. Does anybody knows some perfect setup (best perfomance) to install
> > > mailscanner with spamssassin? some link? some tutorial?
> > Perfect is too much to aim for;-). I usually try for functional:-):-)
>
> :-) :-) .. thanks a lot Glenn
:-)
Cheers
--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
--
Regards;
Israel Garcia
--
This message has been scanned for viruses and
dangerous content by MailScanner , and is
believed to be clean.
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
--
Regards;
Israel Garcia
--
This message has been scanned for viruses and
dangerous content by MailScanner , and is
believed to be clean.
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the MailScanner
mailing list