Re: [exim] Issues with greylisting

On Thu, 2010-01-21 at 10:53 +1300, David Woodhouse wrote:
> I'm kind of surprised that your motivation is based on CPU time rather
> than bandwidth. I've always considered CPU time to be fairly much free
> on a sufficiently capable mail server -- even for SpamAssassin, assuming
> you have enough RAM.

Incidentally, yesterday in $dayjob we got hit with what looked like a
significant botnet hit - in that it started very abruptly but no pattern
(in terms of connecting IP) could be found.

What really hurt was that the injected messages got through all the
pre-DATA checks (of which there are many) and hit SpamAssassin, causing
all 8 cores on 3 MX servers to be completely maxed out. Largely
speaking, SA timed out (or Exim timed out before SA did) so most of the
messages got deferred and not scored.

Oddly enough, it stopped very abruptly too. Unfortunately it consumed a
whole person day mitigating the problem.

So yes, I'd say that CPU is important too (under certain circumstances)!

Graeme