Weird Problem with MailScanner

[Randal, Phil]

Damian,

Which version of Spamassassin are you running?

Can you post the output of

  MailScanner -V

Cheers,

Phil

--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf 
> Of Damian Rivas
> Sent: 22 October 2007 14:42
> To: MailScanner discussion
> Subject: RE: RE: Weird Problem with MailScanner
> 
> It catches and accepts e-mails for our pack of domains: 
> cht.com.ar, aaovyt.com.ar, skalbue.com.ar, 
> hispanoamericana.com.ar, cieduc.com.ar and ci-educ.com.ar.
> 
> The main problem is that domains like hispanoamericana are 
> way too old and recieve lots of spam messages. The main 
> domain, cht.com.ar recieves a lot of mails daily, the problem 
> with this is that it is difficult for me to find a good 
> filter policy, because as it is a Travel Agency it recieves 
> mails from hotels and other agencies, so, if I put a strict 
> filter of "if you are not in my Exchange contact list you 
> cannot pass" this mails are not likely entering any way and 
> that is not the idea.
> 
> I'm following up some guidelines that UxBoD sent me in one of 
> the links to accelerate MS, so I'll let you know if things go better.
> 
> I think that a BackScatter attack is very likely to be 
> happening. Until these last months, there was never a single 
> problem, so something strange might have happened to increase 
> the SPAM bombing and therefore to turn the old server useless.
> 
> And about upgrading memory, I think that it would be cheaper 
> (at least in Argentina PC100 Memories are very expensive as 
> they aren't produced anymore) and have more sense to directly 
> make an entire new server, with better processor and better 
> memory. I was thinking in a 1Ghz processor, is it ok? Which 
> are the minimum recommended requisites?
> 
> ___________________________________________________
>  
> Damián Rivas
> Administrador de Hardware y Redes
> Departamento de Sistemas
> Consult House Turismo S.A.
> Tel: 4315-1900
> email: damian at cht.com.ar
> web: www.cht.com.ar
> 
> 
> -----Mensaje original-----
> De: mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] En nombre 
> de Jason Ede
> Enviado el: lunes, 22 de octubre de 2007 10:08
> Para: MailScanner discussion
> Asunto: RE: RE: Weird Problem with MailScanner
> 
> 
> What domains do you accept email for? Are you sure its not 
> operating as an open gateway?
> 
> Jason
> 
> From: mailscanner-bounces at lists.mailscanner.info 
> [mailscanner-bounces at lists.mailscanner.info] On Behalf Of 
> Damian Rivas [damian at cht.com.ar]
> Sent: 22 October 2007 13:48
> To: MailScanner discussion
> Subject: RE: Weird Problem with MailScanner
> 
> Ok, here we go again. How was your weekend people?
> 
> Ugo, here is the output you asked for:
> 
> vmstat 5 10:
> 
> procs -----------memory---------- ---swap-- -----io---- --system--
> ----cpu----
>  r  b   swpd   free   buff  cache   si   so    bi    bo   in  
>   cs us sy
> id wa
>  0  0 105712  46416  14388  53324    5    3     1     8   13  
>   11 21  1
> 78  0
>  0  0 105712  46264  14392  53324    0    0     0    10  111  
>  171  0  0
> 99  0
>  0  0 105712  46196  14408  53324    0    0     0    24  108  
>  170  0  1
> 99  0
>  0  0 105712  46128  14448  53324    0    0     0    39  112  
>  179  0  0
> 100  0
>  0  0 105712  46132  14456  53324    0    0     0    54  124  
>  174  0  0
> 100  0
>  1  0 105712  44988  14496  53424    0    0    21    89  123  
>  176  8  4
> 88  0
>  0  0 105712  45464  14512  53548    0    0    24    28  110  
>  162  8  3
> 89  0
>  0  0 105712  45264  14628  53612    0    0    22   138  138  
>  208  9  4
> 87  0
>  0  0 105712  46036  14668  53596    0    0     0    61  114  
>  179  0  0
> 100  0
>  2  0 105712  46028  14676  53596    0    0     0     4  105  
>  166  0  0
> 100  0
> 
> I'm also attaching a bit of the output of a tail -f 
> /var/log/maillog for you to see, there's too much spam and 
> false addresses which slowing down MS a lot. There are still 
> about 28k messages!(on Friday there were 45k!!!!).
> 
> UxBoD, you told me to run the init.d script to stop the MS, 
> the problem is Slackware uses the traditional BSD Init, so I 
> went to the 'rc.d' directory but couldn't found, or couldn't 
> figure out were the script for stoping MS is, sorry for my 
> ignorance again.
> 
> As always thank you people for your valuable help.
> 
> Regards.-
> 
> 
> -----Mensaje original-----
> De: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] En nombre 
> de Ugo Bellavance Enviado el: domingo, 21 de octubre de 2007 11:17
> Para: mailscanner at lists.mailscanner.info
> Asunto: Re: Weird Problem with MailScanner
> 
> 
> Damian Rivas wrote:
> > 1) There are 3 MS childs running
> 
> That is way too much. Your system is probably swapping like 
> crazy.  Set it to '1' in /etc/MailScanner/MailScanner.conf 
> and do a 'service MailScanner restart' (assuming redhat/centos)
> 
> Can you send us the output of :
> 
> 'vmstat 5 10' (will take 50 seconds to execute)
> 
> Did you check if memory was available for this system?  If it 
> is and if it is not too expensive, I'll add at least another 
> 128 (more if you can).
> 
> Ugo
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
>