<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1170" name=GENERATOR>
<STYLE>@font-face {
font-family: Tahoma;
}
@page Section1 {size: 595.3pt 841.9pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
P.MsoAutoSig {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoAutoSig {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoAutoSig {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
SPAN.EmailStyle17 {
COLOR: navy; FONT-FAMILY: Arial
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-AU vLink=purple link=blue>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=640214800-13022004>This may seem like a bit of a stretch but I recently
had a similar problem (increase in traffic by over 200%) when I integrated a new
domain into my system. The domain was relatively new and had few users so
I couldn't fathom the load increase. </SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=640214800-13022004></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=640214800-13022004>A week later I was able to trace the problem down to a
user who had their account closed with a rule in exchange to forward the mail
out to an internet account. Eventually this internet account became full
and started to generate mailbox full bounce messages, which in turn eventually
filled up the users mailbox on my exchange system which also started spewing out
mailbox full messages. These messages would bounce very quickly between
boxes, apending the bounce message to the bottom of the message each time.
The bounce messages would replicate up to about 2.5 MB in size in 5k increments
in under 10 minutes for each message the user received. As you can
imagine, this had a major impact on mail traffic. </SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=640214800-13022004></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=640214800-13022004>I would recommend going through a slice of your maillog
to see if you can recognize a pattern. It may be that you process a lot of
very small messages and spam assassin is generating detailed reports in the
headers which is the source of your problem. </SPAN></FONT></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> David Hooton
[mailto:david@PLATFORMHOSTING.COM] <BR><B>Sent:</B> Thursday, February 12, 2004
5:55 PM<BR><B>To:</B> MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re:
MailScanner -> Spamassassin taking insane amount of
bandwidth<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Have you perhaps
considered that the last month's mail traffic has increased fairly
significantly? MyDoom on it's own was more than half of our traffic for a
day or so.</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<DIV>
<P class=MsoAutoSig><FONT face=Arial color=navy size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Regards,</SPAN></FONT></P>
<P class=MsoAutoSig><FONT face=Arial color=navy size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoAutoSig><FONT face=Arial color=navy size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">David
Hooton</SPAN></FONT></P>
<P class=MsoAutoSig><FONT face=Arial color=navy size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Senior
Partner</SPAN></FONT></P>
<P class=MsoAutoSig><FONT face=Arial color=navy size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Platform
Hosting</SPAN></FONT></P>
<P class=MsoAutoSig><FONT face=Arial color=navy size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">1300 85
HOST</SPAN></FONT></P>
<P class=MsoAutoSig><FONT face=Arial color=navy size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">www.platformhosting.com</SPAN></FONT></P></DIV>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<DIV
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0cm; BORDER-TOP: medium none; PADDING-LEFT: 4pt; PADDING-BOTTOM: 0cm; BORDER-LEFT: blue 1.5pt solid; PADDING-TOP: 0cm; BORDER-BOTTOM: medium none">
<P class=MsoNormal><FONT face=Tahoma size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">-----Original
Message-----<BR><B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> MailScanner
mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] <B><SPAN
style="FONT-WEIGHT: bold">On Behalf Of </SPAN></B>Yannick Cayer<BR><B><SPAN
style="FONT-WEIGHT: bold">Sent:</SPAN></B> Friday, 13 February 2004 7:03
AM<BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B>
MAILSCANNER@JISCMAIL.AC.UK<BR><B><SPAN
style="FONT-WEIGHT: bold">Subject:</SPAN></B> MailScanner -> Spamassassin
taking insane amount of bandwidth</SPAN></FONT></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Greetings,</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">I have the following
configuration:</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">mailscanner-4.25-14</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">with spamassassin
2.61</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">sendmail
8.11.6-27</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">on an IBM x235
</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">2 2.4GHZ
Processors</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">1.25 GHZ of
RAM</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Hot swapable raid 5
config.</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">We have about a 100 small sites
configured for mail mostly and some, web.</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">This is running on RedHat Linux 7.3
Kernel 2.4.18-27.7.xsmp</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">We have been running MailScanner on
that machine for almost 2 years now without any
problems.</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Since we have activated the
anti-spam features using SpamAssassin, and standard Spam-Checking throught
the ORBS lists, our bandwidth usage has more than
doubled.</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Before activating that feature, we
were using 80-100GB of bandwidth per month. Now we're up to 224GB for last
month.</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Has anyone ever heard of
SpamAssassin doing this?</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Thank you in advance for your
help.</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV></DIV></DIV>
<HR align=center noShade SIZE=1>
<TABLE cellSpacing=0 cellPadding=0 width="100%" border=0>
<TBODY>
<TR>
<TD vAlign=center><FONT face="Arial, Helvetica, sans-serif" size=2>Pain
free spam & virus protection - <A
href="http://www.mailsecurity.net.au/"><FONT color=#333333>Mail
Security<BR></FONT></A><BR><FONT size=1>To report SPAM forward the message
to: <A href="mailto:spam@mailsecurity.net.au"><FONT
color=#333333>spam@mailsecurity.net.au</FONT></A><BR>To report incorrectly
tagged messages: <A href="mailto:notspam@mailsecurity.net.au"><FONT
color=#333333>notspam@mailsecurity.net.au</FONT></A></FONT></FONT></TD>
<TD vAlign=top>
<DIV align=right><A href="http://www.platformhosting.com/"><IMG height=35
src="http://admin.platformhosting.net/images/platformhosting/powby.gif"
width=131 border=0 NOSEND="1"></A></DIV></TD></TR></TBODY></TABLE>
<HR align=center noShade SIZE=1>
<HR align=center noShade SIZE=1>
<TABLE cellSpacing=0 cellPadding=0 width="100%" border=0>
<TBODY>
<TR>
<TD vAlign=center><FONT face="Arial, Helvetica, sans-serif" size=2>Pain
free spam & virus protection - <A
href="http://www.mailsecurity.net.au/"><FONT color=#333333>Mail
Security<BR></FONT></A><BR><FONT size=1>To report SPAM forward the message
to: <A href="mailto:spam@mailsecurity.net.au"><FONT
color=#333333>spam@mailsecurity.net.au</FONT></A><BR>To report incorrectly
tagged messages: <A href="mailto:notspam@mailsecurity.net.au"><FONT
color=#333333>notspam@mailsecurity.net.au</FONT></A></FONT></FONT></TD>
<TD vAlign=top>
<DIV align=right><A href="http://www.platformhosting.com/"><IMG height=35
src="http://admin.platformhosting.net/images/platformhosting/powby.gif"
width=131 border=0 NOSEND="1"></A></DIV></TD></TR></TBODY></TABLE>
<HR align=center noShade SIZE=1>
</BODY></HTML>