Email causing MailScanner to go defunct.

[Scott Silva]

on 1-23-2009 8:42 AM Steve Campbell spake the following:
> 
> 
> Kai Schaetzl wrote:
>> Steve Campbell wrote on Fri, 23 Jan 2009 10:29:57 -0500:
>>
>>  
>>> If I were to lower the size restrictions, the spam just flows on
>>> through cleanly with a score of 0, so I raise it, and of course, the
>>> load on the machine suffers because it has to scan the larger spams.
>>>     
>>
>> I think most people's experience, including mine, is different. Over a
>> certain value (most likely 50 - 100k) there's almost no spam.
>> (Nowadays, they try to send short messages, so that Bayes hasn't much
>> to work on.) So, going with 200k is a good measure. I was just under
>> the wrong impression that the respective option was working like the
>> usually used procmail recipes.
>>   
> 
> I too was under the same impression you were. I'm not sure if it's the
> comments above the option or not that gave me that impression.
>> I think it would be a good idea to add this functionality (Spam Check
>> only first x Beytes of message") to MS.
>>   
> 
> Same here.
>> Part of your problems could indeed come from the fact that you are
>> scanning many large messages. How high did you set this option?
>>   
> 
> Max Spam Check Size = 4000k
> Max SpamAssassin Size = 2500000
> 
> High value, but like I said, there was a time when emails weren't
> delivered if it were above. Maybe I'm not using the right one.
>> Another thought: in case you are getting so many spam with big size
>> and others don't - could it be that your rejection rate at the MTA
>> level is very low, so that you get spam in that others already reject
>> at the door?
>> If you detect a majority of spam only with MS and not at MTA this
>> could also be another reason for your performance problems.
>>
>>   
> I'm only using sbl-xbl-spamhaus.org right now with my MTA. I've never
> compared rejected versus accepted, but when I tail my maillog, it seems
> as though most email is thrown away. If anyone has a safe suggestion for
> more that I should add to the MTA, please suggest. A lot of my incoming
> is from bursts from news agencies sending alerts to all reporters.
> 
> I just upgraded to the latest. I left startin and startout running. The
> load average dropped to around 0.50, so sendmail is taking minimal
> resources. Once I started MS back up, with about 250 emails queue in the
> input queue, LA rose to 6.5-7.0 and stayed there as it struggles to
> clear the queue along with the new incoming posts.
> 
> MS is showing a footprint of 92M, and most of the RAM (3 GB now for 3
> children) is eaten up. I've removed all SARE rules, and am considering
> cutting KAM rules.
> 
> There were a lot of failed modules during install. The two main ones
> installed fine. MS says it installed fine. I'm just wondering if that
> might have a bearing on this as I'm running Centos 3 here.
> 
>> Kai
>>
>>   
> steve
> 
It is possible that the failed modules are impacting your performance.
As to which blacklists are best, the only way to determine that for your
mailflow is to check the stats of the blacklist hits in spamassassin and move
the ones that have acceptable rates to you to the MTA. The ones that hit 100%
spam are no-brainers, the rest you will have to determine if it is acceptable
to your business.
I can't use spamhaus since I got blacklisted (another long story), but I can
use spamcop, njabl, cbl, sorbs, and psbl with no problems.

Centos 3 is rather old, and maybe the perl version is less than stellar in
performance. If you are running multiple systems, maybe you can work in an
upgrade one node at a time.

-- 
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090123/3fd3a5dd/signature.bin