I used to have SA attached to MailScanner 'til very little time ago.
And SA is not easy to deal as dspam does. Using words from a person
from dspam's list:
"Only with dspam you wouldn't get the terrible SA overhead, plus that
the maintenance
of the two doesn't bear comparison."
On Tue, 08 Mar 2005 08:59:21 +0000, Martin Hepworth
<martinh@???> wrote:
> Axel aghi Hollanda wrote:
> > I run a MX with 20000+ mail boxes. I use Exim 4.43 as MTA along with
> > MailScanner ClamAV as my antivirus server. All my setup is MySQL
> > based.
> > After four months testing Dspam on my test server (company's internal
> > mail server) with 30+ mailboxes, same configuration as my default MX
> > except the number of users, I decided to start dspam all my users
> > because I felt it was really ready and my setup was fine. Wrong.
> > I start using dspam with MySQL 4.0.22 locally, because my Exim uses
> > it.
> > First try:
> >
> > Exim 4.43
> > dspam 3.2.7
> > MySQL 4.0.22 local server (via sock)
> > Global database for dspam with 1.8M+ data entries
> >
> > In the beginning, everything was beautiful. No false-positives, almost
> > every spam got marked. The scan time was oscilating between 0.01 and
> > 3.0s. Deliveries seem fine. But, some hours later, the scan time
> > increased exponentially and there were thousands of dspam processes
> > and Exim's delivery processes.
> >
> > Second try:
> >
> > Same software, no global database group, brand new database.
> >
> > Practically the same behaviour, except the fact of no spam being catch.
> >
> > Third try:
> >
> > Exim 4.43
> > MySQL 4.1.9 remote (via tcp)
> > Global database (same as 1st try)
> >
> > Same behaviour of the first try, but now it worked fine for 8 hours.
> >
> > My MX receives 120K+ messages a day.
> > This is the routers/transports I use for dspam software:
> >
> > ROUTER
> > dspam_router_virtual:
> > no_verify
> > condition = "${if and { \
> > {!def:h_X-FILTER-DSPAM:} \
> > { > { ${strlen:${lookup mysql{select target
> > from redirects where \
> > domain='${quote_mysql:$domain}' and \
> >
> > localpart='${quote_mysql:$local_part}'}}}} {0} } \
> > }\
> > {1}{0}}"
> > headers_add = "X-FILTER-DSPAM: by $primary_hostname on $tod_full"
> > driver = accept
> > transport = dspam_spamcheck
> >
> >
> > dspam_router_local:
> > no_verify
> > condition = "${if and { \
> > {!def:h_X-FILTER-DSPAM:} \
> > { <= {$message_size}{70k}} \
> > { > { ${strlen:${lookup mysql{select login
> > from login where login = '${quote_mysql:$local_part}'}}}} {0} } \
> > }\
> > {1}{0}}"
> > headers_add = "X-FILTER-DSPAM: by $primary_hostname on $tod_full"
> > driver = accept
> > transport = dspam_spamcheck
> >
> > TRANSPORT
> > dspam_spamcheck:
> > driver = pipe
> > command = "/usr/local/bin/dspam --feature=chained,bnr,noise
> > --deliver=innocent,spam --user ${lc:$local_part}@${lc:$domain} -f
> > '$sender_address' -bm %u"
> > home_directory = "/var/dspam"
> > current_directory = "/var/dspam"
> > user = exim
> > group = exim
> > log_output = true
> > return_fail_output = true
> > return_path_add = false
> > message_prefix =
> > message_suffix =
> >
> >
> > Anyone with a close setup? Can you point me to a hardware profile for
> > such configuration?
> > I really don't understand why it's happenning, I can insure that it is
> > no configuration problem because it was tested thoroughly on test
> > server.
> >
> > Thank you.
> >
>
> Axel
>
> This might be a silly question, but why use dspam as a separate
> transport when MailScanner can use Spamassassin which is also very good
> at catching spam and doesn't rely on one technique like dspam does?
>
> Now I'm not being horrible to dspam, but just wondering why you chose
> not to using spamassassin with it nice integration into MailScanner.
>
> I presume you've asked this question on the dspam list?
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
>
--
Aghi
<ahollanda % gmail dot com>
