Axel
fair enough. SA can be quite time consuming to get going well.
of course once it's working well, esp with the URI-RBL's and the
rule_du_jour to update custom rules from third parties, its brilliant.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Axel aghi Hollanda wrote:
> I used to have SA attached to MailScanner 'til very little time ago.
> And SA is not easy to deal as dspam does. Using words from a person
> from dspam's list:
> "Only with dspam you wouldn't get the terrible SA overhead, plus that
> the maintenance
> of the two doesn't bear comparison."
>
>
>
> On Tue, 08 Mar 2005 08:59:21 +0000, Martin Hepworth
> <martinh@???> wrote:
>
>>Axel aghi Hollanda wrote:
>>
>>>I run a MX with 20000+ mail boxes. I use Exim 4.43 as MTA along with
>>>MailScanner ClamAV as my antivirus server. All my setup is MySQL
>>>based.
>>>After four months testing Dspam on my test server (company's internal
>>>mail server) with 30+ mailboxes, same configuration as my default MX
>>>except the number of users, I decided to start dspam all my users
>>>because I felt it was really ready and my setup was fine. Wrong.
>>>I start using dspam with MySQL 4.0.22 locally, because my Exim uses
>>>it.
>>>First try:
>>>
>>>Exim 4.43
>>>dspam 3.2.7
>>>MySQL 4.0.22 local server (via sock)
>>>Global database for dspam with 1.8M+ data entries
>>>
>>>In the beginning, everything was beautiful. No false-positives, almost
>>>every spam got marked. The scan time was oscilating between 0.01 and
>>>3.0s. Deliveries seem fine. But, some hours later, the scan time
>>>increased exponentially and there were thousands of dspam processes
>>>and Exim's delivery processes.
>>>
>>>Second try:
>>>
>>>Same software, no global database group, brand new database.
>>>
>>>Practically the same behaviour, except the fact of no spam being catch.
>>>
>>>Third try:
>>>
>>>Exim 4.43
>>>MySQL 4.1.9 remote (via tcp)
>>>Global database (same as 1st try)
>>>
>>>Same behaviour of the first try, but now it worked fine for 8 hours.
>>>
>>>My MX receives 120K+ messages a day.
>>>This is the routers/transports I use for dspam software:
>>>
>>>ROUTER
>>>dspam_router_virtual:
>>> no_verify
>>> condition = "${if and { \
>>> {!def:h_X-FILTER-DSPAM:} \
>>> { > { ${strlen:${lookup mysql{select target
>>>from redirects where \
>>> domain='${quote_mysql:$domain}' and \
>>>
>>>localpart='${quote_mysql:$local_part}'}}}} {0} } \
>>> }\
>>> {1}{0}}"
>>> headers_add = "X-FILTER-DSPAM: by $primary_hostname on $tod_full"
>>> driver = accept
>>> transport = dspam_spamcheck
>>>
>>>
>>>dspam_router_local:
>>> no_verify
>>> condition = "${if and { \
>>> {!def:h_X-FILTER-DSPAM:} \
>>> { <= {$message_size}{70k}} \
>>> { > { ${strlen:${lookup mysql{select login
>>>from login where login = '${quote_mysql:$local_part}'}}}} {0} } \
>>> }\
>>> {1}{0}}"
>>> headers_add = "X-FILTER-DSPAM: by $primary_hostname on $tod_full"
>>> driver = accept
>>> transport = dspam_spamcheck
>>>
>>>TRANSPORT
>>>dspam_spamcheck:
>>> driver = pipe
>>> command = "/usr/local/bin/dspam --feature=chained,bnr,noise
>>>--deliver=innocent,spam --user ${lc:$local_part}@${lc:$domain} -f
>>>'$sender_address' -bm %u"
>>> home_directory = "/var/dspam"
>>> current_directory = "/var/dspam"
>>> user = exim
>>> group = exim
>>> log_output = true
>>> return_fail_output = true
>>> return_path_add = false
>>> message_prefix =
>>> message_suffix =
>>>
>>>
>>>Anyone with a close setup? Can you point me to a hardware profile for
>>>such configuration?
>>>I really don't understand why it's happenning, I can insure that it is
>>>no configuration problem because it was tested thoroughly on test
>>>server.
>>>
>>>Thank you.
>>>
>>
>>Axel
>>
>>This might be a silly question, but why use dspam as a separate
>>transport when MailScanner can use Spamassassin which is also very good
>>at catching spam and doesn't rely on one technique like dspam does?
>>
>>Now I'm not being horrible to dspam, but just wondering why you chose
>>not to using spamassassin with it nice integration into MailScanner.
>>
>>I presume you've asked this question on the dspam list?
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>
>
>
>
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
