On Nov 27, 2007 1:11 PM, UxBoD <<a href="mailto:uxbod@splatnix.net">uxbod@splatnix.net</a>> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Well ASN is hashed out in your v320 pre file but is still active in the v310 file. </blockquote><div>What does it means?<br> <br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
We process over 100k messages a day on a 256k line so no real worries there. You say a high percentage of your traffic is SMTP, how are you identifying that ? </blockquote><div><br>I can see the traffic in my WAN network using a cisco router/netflow collector.
<br> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Are you performing any sort of packet shaping or QoS then ? </blockquote><div>No
<br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> It does sound to me like DNS timeouts when performing lookups, as others have also said.
</blockquote><div>Well, I use a only caching dns (caching-nameserver-7.3-3)<br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> If you set the list of RBLs to check to blank in
MailScanner.conf does the problem disappear ?</blockquote><div>Do you mean thie line:<br>Spam List = #ORDB-RBL SBL+XBL <a href="http://spamcop.net">spamcop.net</a> NJABL SORBS #<br><br>When the problem disappear is when I set:
<br>Use Spamassassin = no<br>and restart mailscanner... <br><br>thanks in advance<br>Israel<br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br><br>Regards,<br><br>--[ UxBoD ]--<br>// PGP Key: "curl -s <a href="https://www.splatnix.net/uxbod.asc" target="_blank">https://www.splatnix.net/uxbod.asc</a> | gpg --import"<br>// Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B
<br>// Keyserver: <a href="http://www.keyserver.net" target="_blank">www.keyserver.net</a> Key-ID: 0x5DB5687B<br>// Phone: +44 845 869 2749 SIP Phone: <a href="mailto:uxbod@sip.splatnix.net">uxbod@sip.splatnix.net</a><br>
<div class="Ih2E3d"><br>----- Original Message -----<br>From: "Israel Garcia" <<a href="mailto:igalvarez@gmail.com">igalvarez@gmail.com</a>><br>To: "MailScanner discussion" <<a href="mailto:mailscanner@lists.mailscanner.info">
mailscanner@lists.mailscanner.info</a>><br>Sent: Tuesday, November 27, 2007 4:50:20 PM (GMT) Europe/London<br>Subject: Re: Too messages in Hold folder when spamassassin is activated in MailScanner<br><br><br>On Nov 25, 2007 3:56 PM, Glenn Steen <
<a href="mailto:glenn.steen@gmail.com">glenn.steen@gmail.com</a> > wrote:<br><br><br><br><br><br><br>On 25/11/2007, Israel Garcia < <a href="mailto:igalvarez@gmail.com">igalvarez@gmail.com</a> > wrote:<br>> On Nov 25, 2007 2:46 PM, Glenn Steen <
<a href="mailto:glenn.steen@gmail.com">glenn.steen@gmail.com</a> > wrote:<br>><br>> ><br>> ><br>> ><br>> > On 25/11/2007, Israel Garcia < <a href="mailto:igalvarez@gmail.com">igalvarez@gmail.com
</a> > wrote:<br>> > > Hi all, I'm running MailScanner-4.65-3.1(with DCC, razor2, pyzor) on a<br>> > > CentOS4.5 Linux server. I installed too the package<br>> > > install-Clam-0.91.2-SA-3.2.3.tar.gz
in order to<br>> activate spamassassin<br>> > > with mailscanner. I ran spamassassin -D --lint and there's no problem<br>> > > in my configuration files. I also see in maillog file the spamassassin
<br>> > > doing its work with spam:<br>> > ><br>> > > Nov 25 04:54:51 hostname MailScanner[20611]: Message B25732B1DB.A9A63<br></div>> > > from MailScanner warning: numerical links are often malicious:
<a href="http://75.93.188.141" target="_blank">75.93.188.141</a> ( <a href="mailto:jerrimy@donin.com">jerrimy@donin.com</a> ) to <a href="http://mydomain.com" target="_blank">mydomain.com</a> is spam,<br><div><div></div><div class="Wj3C7c">
> > > SBL+XBL, <a href="http://spamcop.net" target="_blank">spamcop.net</a> , SpamAssassin (not cached, score=30.984, required<br>> > > 6, DCC_CHECK 1.37, FH_HELO_EQ_D_D_D_D 0.50, FS_REPLICA 1.18,<br>> > > HELO_DYNAMIC_IPADDR2
4.39, HTML_MESSAGE 0.00, RATWARE_MS_HASH 2.78,<br>> > > RATWARE_OUTLOOK_NONAME 0.00, RCVD_IN_BL_SPAMCOP_NET 2.19, RCVD_IN_XBL<br>> > > 2.90, RDNS_DYNAMIC 0.10 , SARE_SPEC_REPLICA_OBFU 1.81,<br>> > > SARE_SPEC_ROLEX_NOV5A
1.06, TVD_RCVD_IP 1.62, URIBL_AB_SURBL 1.61,<br>> > > URIBL_BLACK 1.96, URIBL_JP_SURBL 2.86, URIBL_OB_SURBL 2.13,<br>> > > URIBL_SC_SURBL 2.52)<br>> > ><br>> > > Everything is fine BUT, when I run "qshape hold" I see the HOLD folder
<br>> > > is FULL of messages waiting to be processed, I mean thousands of mails<br>> > > waiting and there is a long delay in delivering.<br>> > > My link to internet is not full, I mean I see the normal traffic.
<br>> > ><br>> > > So, when I turn off spamassassin in MailScanner.conf there's almost no<br>> > > messages in HOLD foder.<br>> > ><br>> > > My questions are:<br>> > >
<br>> > > 1. How can I speed the spamassassin process in my server?<br>> > Use a caching only DNS, limit what you check (RBLs etc).... There are<br>> > some things to do:-)<br>> ><br>> ><br>
><br>> I have in this server a caching only DNS...<br>> ><br>> ><br>> > > 2. Do I have to use all the plugins (DCC, razor2, pyzor, spamcop, and<br>> > > others that comes activated by default when I install spamassassin
<br>> > > package)?<br>> > No. But they all contribute something:-). WRT Pyzor, make sure you use<br>> > the "alternative" server, the official one will likely just time out.<br>> > What modules do you load?
<br>><br>> I use DCC, razor2, pyzor and all the stuff from /etc/mail/spamassassin<br>> config files:<br>><br>> -rw-r--r-- 1 root root 1089 Jun 2 13:40 init.pre<br>> lrwxrwxrwx 1 root root 41 Jun 2 21:43
<a href="http://local.cf" target="_blank">local.cf</a> -><br>> /etc/MailScanner/spam.assassin.prefs.conf<br>You shouldn't have <a href="http://local.cf" target="_blank">local.cf</a> as a link to spam.assassin.prefs.conf...
.<br>That was more a thing some did before the advent of the <a href="http://mailscanner.cf" target="_blank">mailscanner.cf</a><br>link.<br><a href="http://local.cf" target="_blank">local.cf</a> is a perfect place to have local rescoring etc ... Like
<br>setting dead RBLs to score 0 (thus preventing a timeout problem), or<br>RBLs that might be ... problematic (like if you get firewalled by<br>spamhaus... Check recent threads on the list for a simple test to see<br>if you've been FW'd by them).
<br><br><br>Glenn, sorry my delay in answers you but I was busy with this server... I dont really get what you mean by <a href="http://local.cf" target="_blank">local.cf</a> file.. should I delete the <a href="http://local.cf" target="_blank">
local.cf</a> link?<br><br><br><br><br>> lrwxrwxrwx 1 root root 41 Nov 24 11:00 <a href="http://mailscanner.cf" target="_blank">mailscanner.cf</a> -><br>> /etc/MailScanner/spam.assassin.prefs.conf<br>> drwxr-xr-x 3 root root 4096 Nov 24 15:43 old
<br>> drwxr-xr-x 2 root root 4096 Nov 25 05:05 RulesDuJour<br>> drwx------ 2 root root 4096 Nov 25 05:08 sa-update-keys<br>> -rw-r--r-- 1 root root 2439 Jun 2 14:03 v310.pre<br>> -rw-r--r-- 1 root root 922 Jun 2 13:39
v312.pre<br>> -rw-r--r-- 1 root root 2299 Jun 2 13:40 v320.pre<br><br>I was more thinking along the lines of what loadmodule statements that<br>you have active:-). Check that ASN isn't loaded... for example:-).<br>
If you like, paste result of<br># grep -i loadplug /etc/mail/spamassassin/*.pre<br>Here you go:<br><br>[root@domain.com:/etc/yum.repos.d]$ grep -i loadplug /etc/mail/spamassassin/*.pre<br>/etc/mail/spamassassin/init.pre:# loadplugin Mail::SpamAssassin::Plugin::RelayCountry
<br>/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL<br>/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::Hashcash<br>/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
<br>/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry<br>/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2<br>/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::ASN
<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::DCC<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Pyzor<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::SpamCop<br>/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::AntiVirus<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::AWL
<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold<br>/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::TextCat<br>/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::AccessDB
<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::WhiteListSubject<br>/etc/mail/spamassassin/v310.pre:#loadplugin Mail::SpamAssassin::Plugin::DomainKeys<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::ReplaceTags<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL<br>/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::ASN<br>/etc/mail/spamassassin/v312.pre:#loadplugin Mail::SpamAssassin::Plugin::DKIM
<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Check<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HTTPSMismatch<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIDetail
<br>/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::Shortcircuit<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Bayes<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::BodyEval
<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::DNSEval<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HTMLEval<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::HeaderEval
<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::MIMEEval<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::RelayEval<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIEval
<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::WLBLEval<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::VBounce<br>/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody
<br>/etc/mail/spamassassin/v320.pre:# loadplugin Mail::SpamAssassin::Plugin::ASN<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::ImageInfo<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::RelayCountry
<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::SPF<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
<br>/etc/mail/spamassassin/v320.pre:loadplugin Mail::SpamAssassin::Plugin::ASN<br><br><br><br><br><br>(snip)<br><br>> I'm running to read them NOW! :-)<br>Good. The message never received is the least loading...:-).
<br><br><br><br>So, I have to tell you I'm having the same problem with a lot of messages in HOLD folder when I check mails with spamassassin.. I also note this things:<br><br>1. My link to Internet is FULL and high % is SMTP.
<br>2. I see a laod average high load average: 9.92, 8.29, 7.21 (I have a compaq proliant with two CPUs and 2GB RAM)<br>3. I am processing almost 40000 email <a href="http://daily.is" target="_blank">daily.is</a> it high for this server with 256Kbps Frame relay connection?
<br><br>thanks in advance<br>regards<br>Israel<br><br><br><br><br>><br>> ><br>> ><br>> ><br>> > > 4. Does anybody knows some perfect setup (best perfomance) to install<br>> > > mailscanner with spamssassin? some link? some tutorial?
<br>> > Perfect is too much to aim for;-). I usually try for functional:-):-)<br>><br>> :-) :-) .. thanks a lot Glenn<br>:-)<br><br>Cheers<br>--<br><br><br><br>-- Glenn<br>email: glenn < dot > steen < at > gmail < dot > com
<br>work: glenn < dot > steen < at > ap1 < dot > se<br>--<br>MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">
http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!
<br><br><br><br>--<br>Regards;<br>Israel Garcia<br></div></div>--<br>This message has been scanned for viruses and<br>dangerous content by MailScanner , and is<br>believed to be clean.<br>--<br><div class="Ih2E3d">MailScanner mailing list
<br><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner
</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!<br><br>--<br>
</div>This message has been scanned for viruses and<br>dangerous content by MailScanner, and is<br>believed to be clean.<br><font color="#888888"><br>--<br></font><div><div></div><div class="Wj3C7c">MailScanner mailing list
<br><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner
</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!<br></div></div>
</blockquote></div><br><br clear="all"><br>-- <br>Regards;<br>Israel Garcia