I run a MX with 20000+ mail boxes. I use Exim 4.43 as MTA along with
MailScanner ClamAV as my antivirus server. All my setup is MySQL
based.
After four months testing Dspam on my test server (company's internal
mail server) with 30+ mailboxes, same configuration as my default MX
except the number of users, I decided to start dspam all my users
because I felt it was really ready and my setup was fine. Wrong.
I start using dspam with MySQL 4.0.22 locally, because my Exim uses
it.
First try:
Exim 4.43
dspam 3.2.7
MySQL 4.0.22 local server (via sock)
Global database for dspam with 1.8M+ data entries
In the beginning, everything was beautiful. No false-positives, almost
every spam got marked. The scan time was oscilating between 0.01 and
3.0s. Deliveries seem fine. But, some hours later, the scan time
increased exponentially and there were thousands of dspam processes
and Exim's delivery processes.
Second try:
Same software, no global database group, brand new database.
Practically the same behaviour, except the fact of no spam being catch.
Third try:
Exim 4.43
MySQL 4.1.9 remote (via tcp)
Global database (same as 1st try)
Same behaviour of the first try, but now it worked fine for 8 hours.
My MX receives 120K+ messages a day.
This is the routers/transports I use for dspam software:
ROUTER
dspam_router_virtual:
no_verify
condition = "${if and { \
{!def:h_X-FILTER-DSPAM:} \
{ > { ${strlen:${lookup mysql{select target
from redirects where \
domain='${quote_mysql:$domain}' and \
localpart='${quote_mysql:$local_part}'}}}} {0} } \
}\
{1}{0}}"
headers_add = "X-FILTER-DSPAM: by $primary_hostname on $tod_full"
driver = accept
transport = dspam_spamcheck
dspam_router_local:
no_verify
condition = "${if and { \
{!def:h_X-FILTER-DSPAM:} \
{ <= {$message_size}{70k}} \
{ > { ${strlen:${lookup mysql{select login
from login where login = '${quote_mysql:$local_part}'}}}} {0} } \
}\
{1}{0}}"
headers_add = "X-FILTER-DSPAM: by $primary_hostname on $tod_full"
driver = accept
transport = dspam_spamcheck
TRANSPORT
dspam_spamcheck:
driver = pipe
command = "/usr/local/bin/dspam --feature=chained,bnr,noise
--deliver=innocent,spam --user ${lc:$local_part}@${lc:$domain} -f
'$sender_address' -bm %u"
home_directory = "/var/dspam"
current_directory = "/var/dspam"
user = exim
group = exim
log_output = true
return_fail_output = true
return_path_add = false
message_prefix =
message_suffix =
Anyone with a close setup? Can you point me to a hardware profile for
such configuration?
I really don't understand why it's happenning, I can insure that it is
no configuration problem because it was tested thoroughly on test
server.
Thank you.
--
Aghi
<ahollanda % gmail dot com>
