Axel aghi Hollanda wrote:
> I run a MX with 20000+ mail boxes. I use Exim 4.43 as MTA along with
> MailScanner ClamAV as my antivirus server. All my setup is MySQL
> based.
> After four months testing Dspam on my test server (company's internal
> mail server) with 30+ mailboxes, same configuration as my default MX
> except the number of users, I decided to start dspam all my users
> because I felt it was really ready and my setup was fine. Wrong.
> I start using dspam with MySQL 4.0.22 locally, because my Exim uses
> it.
> First try:
>
> Exim 4.43
> dspam 3.2.7
> MySQL 4.0.22 local server (via sock)
> Global database for dspam with 1.8M+ data entries
>
> In the beginning, everything was beautiful. No false-positives, almost
> every spam got marked. The scan time was oscilating between 0.01 and
> 3.0s. Deliveries seem fine. But, some hours later, the scan time
> increased exponentially and there were thousands of dspam processes
> and Exim's delivery processes.
>
> Second try:
>
> Same software, no global database group, brand new database.
>
> Practically the same behaviour, except the fact of no spam being catch.
>
> Third try:
>
> Exim 4.43
> MySQL 4.1.9 remote (via tcp)
> Global database (same as 1st try)
>
> Same behaviour of the first try, but now it worked fine for 8 hours.
>
> My MX receives 120K+ messages a day.
> This is the routers/transports I use for dspam software:
>
> ROUTER
> dspam_router_virtual:
> no_verify
> condition = "${if and { \
> {!def:h_X-FILTER-DSPAM:} \
> { > { ${strlen:${lookup mysql{select target
> from redirects where \
> domain='${quote_mysql:$domain}' and \
>
> localpart='${quote_mysql:$local_part}'}}}} {0} } \
> }\
> {1}{0}}"
> headers_add = "X-FILTER-DSPAM: by $primary_hostname on $tod_full"
> driver = accept
> transport = dspam_spamcheck
>
>
> dspam_router_local:
> no_verify
> condition = "${if and { \
> {!def:h_X-FILTER-DSPAM:} \
> { <= {$message_size}{70k}} \
> { > { ${strlen:${lookup mysql{select login
> from login where login = '${quote_mysql:$local_part}'}}}} {0} } \
> }\
> {1}{0}}"
> headers_add = "X-FILTER-DSPAM: by $primary_hostname on $tod_full"
> driver = accept
> transport = dspam_spamcheck
>
> TRANSPORT
> dspam_spamcheck:
> driver = pipe
> command = "/usr/local/bin/dspam --feature=chained,bnr,noise
> --deliver=innocent,spam --user ${lc:$local_part}@${lc:$domain} -f
> '$sender_address' -bm %u"
> home_directory = "/var/dspam"
> current_directory = "/var/dspam"
> user = exim
> group = exim
> log_output = true
> return_fail_output = true
> return_path_add = false
> message_prefix =
> message_suffix =
>
>
> Anyone with a close setup? Can you point me to a hardware profile for
> such configuration?
> I really don't understand why it's happenning, I can insure that it is
> no configuration problem because it was tested thoroughly on test
> server.
>
> Thank you.
>
Axel
This might be a silly question, but why use dspam as a separate
transport when MailScanner can use Spamassassin which is also very good
at catching spam and doesn't rely on one technique like dspam does?
Now I'm not being horrible to dspam, but just wondering why you chose
not to using spamassassin with it nice integration into MailScanner.
I presume you've asked this question on the dspam list?
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
