You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Josef Karliak <ka...@ajetaci.cz> on 2013/04/03 09:04:49 UTC
Spamassassin 3.3.2 and load problem od DL380G5 ?
Good morning,
we use SA on 8 CPUs HP DL380 G5. But sometimes spam daemon crash down :
Apr 2 18:01:33 server systemd[1]: spamd.service: main process exited,
code=exited, status=1
Apr 2 18:01:33 server systemd[1]: Unit spamd.service entered failed state.
In this time there were a high load (some user sent quite a lot of
emails - about 800 ). In "/etc/sysconfig/spamd" I've startup arguments:
SPAMD_ARGS="-d -c -L --max-children=40 --min-children=15
--min-spare=5 -i 0.0.0.0 -A 192.168.67.1 -A 127.0.0.1"
Is that OK ? Or what do you recommend ?
Running on Opensuse 12.2 x64
Thanks and best regards
J.Karliak.
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 04.04.13 08:04, Josef Karliak wrote:
> that is all log I've from "/var/log/messages". Mail system logs to
>"/var/log/mail", there is nothing about spamd crashing too :-/. No
>exceptions, no segfaults, ...
you should apparently learn how syslog mechanism works and use it for such
cases. On systems with huge traffic, it's beter to separate logging of some
kinds of information to special file, while increasing logs verbosity.
e.g. sending all mail severity logs (maybe except debug level) to
/var/log/mail, including (or excluding) spamd logs.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
WinError #98652: Operation completed successfully.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Josef Karliak <ka...@ajetaci.cz>.
Hi,
that is all log I've from "/var/log/messages". Mail system logs to
"/var/log/mail", there is nothing about spamd crashing too :-/. No
exceptions, no segfaults, ...
J.Karliak.
Cituji Henrik K <he...@hege.li>:
>
> On Wed, Apr 03, 2013 at 09:04:49AM +0200, Josef Karliak wrote:
>> Good morning,
>> we use SA on 8 CPUs HP DL380 G5. But sometimes spam daemon crash down :
>> Apr 2 18:01:33 server systemd[1]: spamd.service: main process
>> exited, code=exited, status=1
>> Apr 2 18:01:33 server systemd[1]: Unit spamd.service entered failed state.
>
> This does not tell us anything. Where are spamd logs? Does kernel log say
> process crashed? Are there any core dumps?
>
>
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Henrik K <he...@hege.li>.
On Wed, Apr 03, 2013 at 09:04:49AM +0200, Josef Karliak wrote:
> Good morning,
> we use SA on 8 CPUs HP DL380 G5. But sometimes spam daemon crash down :
> Apr 2 18:01:33 server systemd[1]: spamd.service: main process
> exited, code=exited, status=1
> Apr 2 18:01:33 server systemd[1]: Unit spamd.service entered failed state.
This does not tell us anything. Where are spamd logs? Does kernel log say
process crashed? Are there any core dumps?
Re: Spamassassin 3.3.2 and load problem od DL380G5?
Posted by Benny Pedersen <me...@junc.eu>.
Matus UHLAR - fantomas skrev den 2013-04-03 15:53:
> On 03.04.13 15:36, Josef Karliak wrote:
>> server has enough of memory - 16GB RAM, swap is 32GB, swapped about
>> 77 MB. Are the startup parameters good enough for this?
>
> looks good :-)
ready to test how fast 32GB swap is ? :)
noticed he use opensuse 12.2, but latest is as easy as 12.3 :)
what kernel is in use ?
join opensuse maillist / irc to get help on this problem, if there is
any
>> I've added a custom rulesets a long time ago - META rules. And I've
>> modified rules scores.
>> Anyway - it is able to run spamass on a another CPUs ? In the
>> gkrellm I see that one CPU is on 100% load and another 7 CPU has a
>> minimal load...
userland tools needs to support threads, it thay do not, it will be as
fast as single core, is perl thread enabled ?
you run x11 on a server ?, lol :=)
> each SA instance should run on different CPU. You can even
> enable hyperthreading in this case, it may help much.
> However the CPU load looks suspicious...
+1
note i did try upgrade opensuse 12.2 to 12.3 it failed, but the issue i
have is that my hp server have no 3D hardware and the x11 drivers breaks
in 12.3 where it worked in 12.2, still just dont know with one :(
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 03.04.13 15:36, Josef Karliak wrote:
> server has enough of memory - 16GB RAM, swap is 32GB, swapped about
>77 MB. Are the startup parameters good enough for this?
looks good :-)
> I've added a custom rulesets a long time ago - META rules. And I've
>modified rules scores.
> Anyway - it is able to run spamass on a another CPUs ? In the
>gkrellm I see that one CPU is on 100% load and another 7 CPU has a
>minimal load...
each SA instance should run on different CPU. You can even
enable hyperthreading in this case, it may help much.
However the CPU load looks suspicious...
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Windows found: (R)emove, (E)rase, (D)elete
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Josef Karliak <ka...@ajetaci.cz>.
Good afternoon,
server has enough of memory - 16GB RAM, swap is 32GB, swapped about
77 MB. Are the startup parameters good enough for this?
I've added a custom rulesets a long time ago - META rules. And I've
modified rules scores.
Anyway - it is able to run spamass on a another CPUs ? In the
gkrellm I see that one CPU is on 100% load and another 7 CPU has a
minimal load...
Thanks
J.Karliak
Cituji Dirk Bonengel <di...@gmx.de>:
> Am 03.04.2013 09:45, schrieb David B Funk:
>> On Wed, 3 Apr 2013, Josef Karliak wrote:
>>
>>> Good morning,
>>> we use SA on 8 CPUs HP DL380 G5. But sometimes spam daemon crash down :
>>> Apr 2 18:01:33 server systemd[1]: spamd.service: main process
>>> exited, code=exited, status=1
>>> Apr 2 18:01:33 server systemd[1]: Unit spamd.service entered failed state.
>>>
>>> In this time there were a high load (some user sent quite a lot of
>>> emails - about 800 ). In "/etc/sysconfig/spamd" I've startup
>>> arguments:
>>>
>>> SPAMD_ARGS="-d -c -L --max-children=40 --min-children=15
>>> --min-spare=5 -i 0.0.0.0 -A 192.168.67.1 -A 127.0.0.1"
>>>
>>> Is that OK ? Or what do you recommend ?
>>> Running on Opensuse 12.2 x64
>>>
>>> Thanks and best regards
>>> J.Karliak.
>>
>> You have a possible maximum of 40 spamd processes. Make sure you have enough
>> RAM to support them all. If you hit swap you're asking for trouble.
>> If limited RAM either add more or reduce that max-children parameter.
>> Better to have a work backlog than thrash swap.
>>
>> Use 'sa-compile' to speed up processing and a local caching DNS server to
>> reduce the effect of network delays.
>>
>> Have you added any custom rulesets? Some custom rulesets can add a
>> significant workload and may not be worth the extra overhead.
>>
> Are those your users sending lots of mails? Then what is the point
> in submitting them to SpamAssassin? Bypassing SA might save your
> lots of trouble (and ressources)
> My 2 EUR-Cent
>
> Dirk
>
>
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>>On 03.04.13 10:58, Dirk Bonengel wrote:
>>>Are those your users sending lots of mails? Then what is the
>>>point in submitting them to SpamAssassin? Bypassing SA might save
>>>your lots of trouble (and ressources)
>Am 03.04.2013 15:50, schrieb Matus UHLAR - fantomas:
>>scanning outgoing mail by SA can save companies from problems when their
>>users start spamming. While many tests (mostly those related to
>>blacklists)
>>in such case do not work much, it still can help.
On 04.04.13 11:32, Dirk Bonengel wrote:
>The question is: Is this wanted here? The original poster mentions
>users sending out 800 mails at once. I take it they're not spamming.
>On this assumption I'd recommend bypassing SA/spamd for outgoing mails.
The more mails are being sent at once, the higher is the probability that
they are spams. And the more spams are being sent once, the higher
probability of real problems. I see this as two reasons to scan outgoing
mail.
If the particular customer has special needs in sending mail, a dedicated
mail service is ideal. Such service can be built for these cases only.
I prefer scanninng mail as it comes through, with possibility of returning
rejection code if it fails checking (viruses, spam, etc). In these cases,
only virus scanning is apparently viable, with delayed spam scanning.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
WinError #99999: Out of error messages.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Axb <ax...@gmail.com>.
On 04/05/2013 09:38 AM, Josef Karliak wrote:
> Hi,
> I made yesterday some mail stress tests - I found some perl script
> that send defined count of emails. I sent 1000 emails and SA didn't
> crashed. All 8 cores had 100% (this means that hyperthread is enabled
> and mentioned one 100 CPU wasn't SA loading). Since crashing a few days
> ago there are some changes that I made - message size that checks SA was
> 1MB, I set it to 100kB (once a time we had spams that had 900kB) and
> decreased min-children from 15 -> 5.
100kb my be too low if you're sharing SA config for inbound & outbound.
iirc, default is 512kb which will produce better results - less missed
spams.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 05.04.13 09:38, Josef Karliak wrote:
> I made yesterday some mail stress tests - I found some perl script
>that send defined count of emails. I sent 1000 emails and SA didn't
>crashed. All 8 cores had 100% (this means that hyperthread is enabled
>and mentioned one 100 CPU wasn't SA loading). Since crashing a few
>days ago there are some changes that I made - message size that
>checks SA was 1MB, I set it to 100kB (once a time we had spams that
>had 900kB) and decreased min-children from 15 -> 5.
I use 20MB (same as maximum allowed message size here), since I don't
receive much mail. When I have used the default (512KB), I got some spam
passing through.
> Anyway - I'm aware about some disadvantages about dkim, spf or so.
>But there are many admins, that has servers without reverse dns, many
>mails is in html format etc and SA consider this emails as a spam.
>This is a reason that we started using this test and publishing our
>SPF policy and started DKIM signing. And SPF helped us too (many
>spams are from "us" to "us" :) ).
Note that I'm not objecting against SPF nor DKIM. I'm just telling that you
should NOT treat mail as non-spam (=ham) just because its SPF and DKIM are
valid. Some spammers send e-mail with valid SPF checks. Some mails come from
hosts with valid DKIM checks.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Saving Private Ryan...
Private Ryan exists. Overwrite? (Y/N)
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Josef Karliak <ka...@ajetaci.cz>.
Hi,
I made yesterday some mail stress tests - I found some perl script
that send defined count of emails. I sent 1000 emails and SA didn't
crashed. All 8 cores had 100% (this means that hyperthread is enabled
and mentioned one 100 CPU wasn't SA loading). Since crashing a few
days ago there are some changes that I made - message size that checks
SA was 1MB, I set it to 100kB (once a time we had spams that had
900kB) and decreased min-children from 15 -> 5.
Anyway - I'm aware about some disadvantages about dkim, spf or so.
But there are many admins, that has servers without reverse dns, many
mails is in html format etc and SA consider this emails as a spam.
This is a reason that we started using this test and publishing our
SPF policy and started DKIM signing. And SPF helped us too (many spams
are from "us" to "us" :) ).
Now I've the rules and scores tunned, the spams that passed thru
users sends me to our spam mailbox and often it is reported to
spamcop. And I check what caused passing thru. We've daily about 10000
- 15000 emails, spams coughted by SA are a few thousands, spams passed
thru are a few dozens as I can see by the spams sent to my spam
mailbox from users. Of course, some time spamers finds domains with
spf=+all or so :)
J.K.
Cituji Matus UHLAR - fantomas <uh...@fantomas.sk>:
> On 04.04.13 14:09, Josef Karliak wrote:
>> we've one "collecting" smtp server (without SA), one antispam
>> server (SA and this server sends outgoing email1) and one email
>> server (cyrus imap server). We've about 3000 active email users -
>> here is a fast picture
>> http://www.ajetaci.cz/skola/epi/zumpa/rychle_zapojeni_firewall_antispam_email.png
>
> So, when you accept mail from the net, you first collect it by an SMTP
> server and then filter it out? I recommend the opposite, especially for
> your case:
>
> - receive mail from internet directly to server that can do spam and
> recipient checks, so you can REJECT both mail to unknown users and the
> spam at SMTP level
> - receive mail from local users by te same server, so you can do the same
> checks (at SMTP time)
> - have one extra SMTP server for special users or special cases as this one,
> that can accept all the mail and submit through mail hub, which will
> either pass through main server or SA-scan after accepting the mail
> (you may have to deal with undeliverable spam, backscatter etc)
>
> - if you want special server for mailboxes (IMAP and POP3), if can receive
> mail from the main server
>
>> About filtering email - when the scanned email has SPF, Domainkeys
>> or DKIM =="pass", I've some rules with SCORE "-10" or so, so the
>> email is trustworthy. Including ours.
>
> Are you aware that the whole fact that mail passes SPF or DKIM checks tells
> COMPLETELY NOTHING about its spamminess? they can be spam as well, and I do
> NOT recommend using SPF for anything than positive scoring when the mail
> FAILS those tests.
>
> --
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> "One World. One Web. One Program." - Microsoft promotional advertisement
> "Ein Volk, ein Reich, ein Fuhrer!" - Adolf Hitler
>
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Josef Karliak <ka...@ajetaci.cz>.
As a mail server (pop3/imap) we use Cyrus imap server.
J.K.
Cituji nightduke <ni...@gmail.com>:
> Hi i would like to ask what mail server do you use?
>
> Regards
>
> Nightduke
>
> 2013/4/4 Matus UHLAR - fantomas <uh...@fantomas.sk>:
>> On 04.04.13 14:09, Josef Karliak wrote:
>>>
>>> we've one "collecting" smtp server (without SA), one antispam server (SA
>>> and this server sends outgoing email1) and one email server (cyrus imap
>>> server). We've about 3000 active email users - here is a fast picture
>>>
>>> http://www.ajetaci.cz/skola/epi/zumpa/rychle_zapojeni_firewall_antispam_email.png
>>
>>
>> So, when you accept mail from the net, you first collect it by an SMTP
>> server and then filter it out? I recommend the opposite, especially for
>> your case:
>>
>> - receive mail from internet directly to server that can do spam and
>> recipient checks, so you can REJECT both mail to unknown users and the
>> spam at SMTP level
>> - receive mail from local users by te same server, so you can do the same
>> checks (at SMTP time)
>> - have one extra SMTP server for special users or special cases as this one,
>> that can accept all the mail and submit through mail hub, which will
>> either pass through main server or SA-scan after accepting the mail
>> (you may have to deal with undeliverable spam, backscatter etc)
>>
>> - if you want special server for mailboxes (IMAP and POP3), if can receive
>> mail from the main server
>>
>>
>>> About filtering email - when the scanned email has SPF, Domainkeys or
>>> DKIM =="pass", I've some rules with SCORE "-10" or so, so the email is
>>> trustworthy. Including ours.
>>
>>
>> Are you aware that the whole fact that mail passes SPF or DKIM checks tells
>> COMPLETELY NOTHING about its spamminess? they can be spam as well, and I do
>> NOT recommend using SPF for anything than positive scoring when the mail
>> FAILS those tests.
>>
>>
>> --
>> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
>> Warning: I wish NOT to receive e-mail advertising to this address.
>> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
>> "One World. One Web. One Program." - Microsoft promotional advertisement
>> "Ein Volk, ein Reich, ein Fuhrer!" - Adolf Hitler
>
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by nightduke <ni...@gmail.com>.
Hi i would like to ask what mail server do you use?
Regards
Nightduke
2013/4/4 Matus UHLAR - fantomas <uh...@fantomas.sk>:
> On 04.04.13 14:09, Josef Karliak wrote:
>>
>> we've one "collecting" smtp server (without SA), one antispam server (SA
>> and this server sends outgoing email1) and one email server (cyrus imap
>> server). We've about 3000 active email users - here is a fast picture
>>
>> http://www.ajetaci.cz/skola/epi/zumpa/rychle_zapojeni_firewall_antispam_email.png
>
>
> So, when you accept mail from the net, you first collect it by an SMTP
> server and then filter it out? I recommend the opposite, especially for
> your case:
>
> - receive mail from internet directly to server that can do spam and
> recipient checks, so you can REJECT both mail to unknown users and the
> spam at SMTP level
> - receive mail from local users by te same server, so you can do the same
> checks (at SMTP time)
> - have one extra SMTP server for special users or special cases as this one,
> that can accept all the mail and submit through mail hub, which will
> either pass through main server or SA-scan after accepting the mail
> (you may have to deal with undeliverable spam, backscatter etc)
>
> - if you want special server for mailboxes (IMAP and POP3), if can receive
> mail from the main server
>
>
>> About filtering email - when the scanned email has SPF, Domainkeys or
>> DKIM =="pass", I've some rules with SCORE "-10" or so, so the email is
>> trustworthy. Including ours.
>
>
> Are you aware that the whole fact that mail passes SPF or DKIM checks tells
> COMPLETELY NOTHING about its spamminess? they can be spam as well, and I do
> NOT recommend using SPF for anything than positive scoring when the mail
> FAILS those tests.
>
>
> --
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> "One World. One Web. One Program." - Microsoft promotional advertisement
> "Ein Volk, ein Reich, ein Fuhrer!" - Adolf Hitler
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 04.04.13 14:09, Josef Karliak wrote:
> we've one "collecting" smtp server (without SA), one antispam
>server (SA and this server sends outgoing email1) and one email
>server (cyrus imap server). We've about 3000 active email users -
>here is a fast picture
>http://www.ajetaci.cz/skola/epi/zumpa/rychle_zapojeni_firewall_antispam_email.png
So, when you accept mail from the net, you first collect it by an SMTP
server and then filter it out? I recommend the opposite, especially for
your case:
- receive mail from internet directly to server that can do spam and
recipient checks, so you can REJECT both mail to unknown users and the
spam at SMTP level
- receive mail from local users by te same server, so you can do the same
checks (at SMTP time)
- have one extra SMTP server for special users or special cases as this one,
that can accept all the mail and submit through mail hub, which will
either pass through main server or SA-scan after accepting the mail
(you may have to deal with undeliverable spam, backscatter etc)
- if you want special server for mailboxes (IMAP and POP3), if can receive
mail from the main server
> About filtering email - when the scanned email has SPF, Domainkeys
>or DKIM =="pass", I've some rules with SCORE "-10" or so, so the
>email is trustworthy. Including ours.
Are you aware that the whole fact that mail passes SPF or DKIM checks tells
COMPLETELY NOTHING about its spamminess? they can be spam as well, and I do
NOT recommend using SPF for anything than positive scoring when the mail
FAILS those tests.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"One World. One Web. One Program." - Microsoft promotional advertisement
"Ein Volk, ein Reich, ein Fuhrer!" - Adolf Hitler
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Josef Karliak <ka...@ajetaci.cz>.
Hi,
we've one "collecting" smtp server (without SA), one antispam
server (SA and this server sends outgoing email1) and one email server
(cyrus imap server). We've about 3000 active email users - here is a
fast picture
http://www.ajetaci.cz/skola/epi/zumpa/rychle_zapojeni_firewall_antispam_email.png
About filtering email - when the scanned email has SPF, Domainkeys
or DKIM =="pass", I've some rules with SCORE "-10" or so, so the email
is trustworthy. Including ours. But - yahoo, google etc. are
freemails, abused for spamming - let the spamcop live :)
Cituji Matus UHLAR - fantomas <uh...@fantomas.sk>:
> On 04.04.13 13:03, Josef Karliak wrote:
>> antispam server is in dmz, emails are sent to antispam server thru
>> postfix on firewall. The firewall is for incoming emails from local
>> network and from internet. Firewall send emails to antispam server.
>> This server serves as an outgoing server too. I email isn't
>> outgoing to the internet, this server send the email to another
>> server - email server:
>>
>> (incoming SMTP server)->(DMZ antispam server+outgoing)->(DMZ email
>> server for our users)
>> LAN / \NET
>
> Well I'm completely lost here, how many mail servers do you have?
> How do messages come from the internet to your network and vice versa?
> Do your servers communicate with your antispam server by spamd protocol or
> via SMTP?
>
>> SA has defined an internal network, so emails from inside are trustworthy.
>
> Defining network as trusted and/or internal in SA does NOT mean that mail
> will not be marked as spam. Trusted network only means that hosts will be
> trusted not to fake Received: headers, which is later used in decising
> whether to scan blacklists for server IPs.
>
>> And I use DKIM for signing internal emails (firewall signs all
>> emails from local and dmz zone), so it is not possible to filter
>> email as a spam from a local or dmz zone.
>
> the only way to avoid SA from scanning mail is not to pass the mail through
> SA. If you pass the mail through SA, it will be scanned and possibly marked
> as spam.
>
> --
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> Due to unexpected conditions Windows 2000 will be released
> in first quarter of year 1901
>
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 04.04.13 13:03, Josef Karliak wrote:
> antispam server is in dmz, emails are sent to antispam server thru
>postfix on firewall. The firewall is for incoming emails from local
>network and from internet. Firewall send emails to antispam server.
>This server serves as an outgoing server too. I email isn't outgoing
>to the internet, this server send the email to another server - email
>server:
>
>(incoming SMTP server)->(DMZ antispam server+outgoing)->(DMZ email
>server for our users)
>LAN / \NET
Well I'm completely lost here, how many mail servers do you have?
How do messages come from the internet to your network and vice versa?
Do your servers communicate with your antispam server by spamd protocol or
via SMTP?
> SA has defined an internal network, so emails from inside are
>trustworthy.
Defining network as trusted and/or internal in SA does NOT mean that mail
will not be marked as spam. Trusted network only means that hosts will be
trusted not to fake Received: headers, which is later used in decising
whether to scan blacklists for server IPs.
> And I use DKIM for signing internal emails (firewall
>signs all emails from local and dmz zone), so it is not possible to
>filter email as a spam from a local or dmz zone.
the only way to avoid SA from scanning mail is not to pass the mail through
SA. If you pass the mail through SA, it will be scanned and possibly marked
as spam.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Due to unexpected conditions Windows 2000 will be released
in first quarter of year 1901
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Josef Karliak <ka...@ajetaci.cz>.
Hi there,
antispam server is in dmz, emails are sent to antispam server thru
postfix on firewall. The firewall is for incoming emails from local
network and from internet. Firewall send emails to antispam server.
This server serves as an outgoing server too. I email isn't outgoing
to the internet, this server send the email to another server - email
server:
(incoming SMTP server)->(DMZ antispam server+outgoing)->(DMZ email
server for our users)
LAN / \NET
SA has defined an internal network, so emails from inside are
trustworthy. And I use DKIM for signing internal emails (firewall
signs all emails from local and dmz zone), so it is not possible to
filter email as a spam from a local or dmz zone.
J.Karliak.
Cituji Dirk Bonengel <di...@gmx.de>:
>
>
> Am 03.04.2013 15:50, schrieb Matus UHLAR - fantomas:
>> On 03.04.13 10:58, Dirk Bonengel wrote:
>>> Are those your users sending lots of mails? Then what is the point
>>> in submitting them to SpamAssassin? Bypassing SA might save your
>>> lots of trouble (and ressources)
>>
>> scanning outgoing mail by SA can save companies from problems when their
>> users start spamming. While many tests (mostly those related to blacklists)
>> in such case do not work much, it still can help.
> The question is: Is this wanted here? The original poster mentions
> users sending out 800 mails at once. I take it they're not spamming.
> On this assumption I'd recommend bypassing SA/spamd for outgoing mails.
>
>
>
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Dirk Bonengel <di...@gmx.de>.
Am 03.04.2013 15:50, schrieb Matus UHLAR - fantomas:
> On 03.04.13 10:58, Dirk Bonengel wrote:
>> Are those your users sending lots of mails? Then what is the point in
>> submitting them to SpamAssassin? Bypassing SA might save your lots of
>> trouble (and ressources)
>
> scanning outgoing mail by SA can save companies from problems when their
> users start spamming. While many tests (mostly those related to
> blacklists)
> in such case do not work much, it still can help.
The question is: Is this wanted here? The original poster mentions users
sending out 800 mails at once. I take it they're not spamming.
On this assumption I'd recommend bypassing SA/spamd for outgoing mails.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 03.04.13 10:58, Dirk Bonengel wrote:
>Are those your users sending lots of mails? Then what is the point in
>submitting them to SpamAssassin? Bypassing SA might save your lots of
>trouble (and ressources)
scanning outgoing mail by SA can save companies from problems when their
users start spamming. While many tests (mostly those related to blacklists)
in such case do not work much, it still can help.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
LSD will make your ECS screen display 16.7 million colors
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Dirk Bonengel <di...@gmx.de>.
Am 03.04.2013 09:45, schrieb David B Funk:
> On Wed, 3 Apr 2013, Josef Karliak wrote:
>
>> Good morning,
>> we use SA on 8 CPUs HP DL380 G5. But sometimes spam daemon crash down :
>> Apr 2 18:01:33 server systemd[1]: spamd.service: main process exited,
>> code=exited, status=1
>> Apr 2 18:01:33 server systemd[1]: Unit spamd.service entered failed
>> state.
>>
>> In this time there were a high load (some user sent quite a lot of
>> emails - about 800 ). In "/etc/sysconfig/spamd" I've startup arguments:
>>
>> SPAMD_ARGS="-d -c -L --max-children=40 --min-children=15
>> --min-spare=5 -i 0.0.0.0 -A 192.168.67.1 -A 127.0.0.1"
>>
>> Is that OK ? Or what do you recommend ?
>> Running on Opensuse 12.2 x64
>>
>> Thanks and best regards
>> J.Karliak.
>
> You have a possible maximum of 40 spamd processes. Make sure you have
> enough
> RAM to support them all. If you hit swap you're asking for trouble.
> If limited RAM either add more or reduce that max-children parameter.
> Better to have a work backlog than thrash swap.
>
> Use 'sa-compile' to speed up processing and a local caching DNS server to
> reduce the effect of network delays.
>
> Have you added any custom rulesets? Some custom rulesets can add a
> significant workload and may not be worth the extra overhead.
>
Are those your users sending lots of mails? Then what is the point in
submitting them to SpamAssassin? Bypassing SA might save your lots of
trouble (and ressources)
My 2 €-Cent
Dirk
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Wed, 3 Apr 2013, Josef Karliak wrote:
> Good morning,
> we use SA on 8 CPUs HP DL380 G5. But sometimes spam daemon crash down :
> Apr 2 18:01:33 server systemd[1]: spamd.service: main process exited,
> code=exited, status=1
> Apr 2 18:01:33 server systemd[1]: Unit spamd.service entered failed state.
>
> In this time there were a high load (some user sent quite a lot of emails -
> about 800 ). In "/etc/sysconfig/spamd" I've startup arguments:
>
> SPAMD_ARGS="-d -c -L --max-children=40 --min-children=15 --min-spare=5 -i
> 0.0.0.0 -A 192.168.67.1 -A 127.0.0.1"
>
> Is that OK ? Or what do you recommend ?
> Running on Opensuse 12.2 x64
>
> Thanks and best regards
> J.Karliak.
You have a possible maximum of 40 spamd processes. Make sure you have enough
RAM to support them all. If you hit swap you're asking for trouble.
If limited RAM either add more or reduce that max-children parameter.
Better to have a work backlog than thrash swap.
Use 'sa-compile' to speed up processing and a local caching DNS server to
reduce the effect of network delays.
Have you added any custom rulesets? Some custom rulesets can add a
significant workload and may not be worth the extra overhead.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Josef Karliak <ka...@ajetaci.cz>.
Hi there,
OK, I increased to 5 min-children. Anyway running spamd with "-D"
increased a mail log too many :). Now it is up to 100MB, but with "-D"
... I asked an user that sent a lot of emails to tell me about next
"batch", I try run spamd with "-D" on his batch, not for all time.
I know that opensuse 12.3 exists, distro upgrade i waitting for me
a some expericiencies too. I upgraded on 12.2 from old 11.4 a few days
before 12.3 released.
And - yes, X server is installed, but not used, I'm running it in
runlevel 3. Onetimes I installed server in text mode - but there were
a lot of packages, that I had to install anyway (dependencies). So I
decided to install X, but not use it.
Kernel that I use:
Linux server 3.4.28-2.20-desktop #1 SMP PREEMPT Tue Jan 29 16:51:37
UTC 2013 (143156b) x86_64 x86_64 x86_64 GNU/Linux
For explanation - I use "desktop" kernel because it is default on
opensuse and when I looked at
"http://forums.opensuse.org/english/get-technical-help-here/install-boot-login/446089-default-versus-desktop.html", there are not a big differencies - except some optimalization of desktop kernel for desktop optimalization. But it is true, that kernel "default" should be used on the servers. But what is server - a few years ago we had servers on desktop machines
:).
Cpu (8x):
model name : Intel(R) Xeon(R) CPU E5345 @ 2.33GHz
This cpu has a hyperthreading and it is enabled by default, isn't it?
Thanks you all and best regards
J.Karliak
Cituji Axb <ax...@gmail.com>:
> On 04/03/2013 09:04 AM, Josef Karliak wrote:
>> Good morning,
>> we use SA on 8 CPUs HP DL380 G5. But sometimes spam daemon crash down :
>> Apr 2 18:01:33 server systemd[1]: spamd.service: main process exited,
>> code=exited, status=1
>> Apr 2 18:01:33 server systemd[1]: Unit spamd.service entered failed state.
>>
>> In this time there were a high load (some user sent quite a lot of
>> emails - about 800 ). In "/etc/sysconfig/spamd" I've startup arguments:
>>
>> SPAMD_ARGS="-d -c -L --max-children=40 --min-children=15
>> --min-spare=5 -i 0.0.0.0 -A 192.168.67.1 -A 127.0.0.1"
>>
>> Is that OK ? Or what do you recommend ?
>> Running on Opensuse 12.2 x64
>
> do you really need --min-children=15 ?
>
> bring it down to 5 and let us know what happens.
>
> Running spamd in -D mode for a short period of high traffic may help
> you find some other issues.
>
>
>
>
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin 3.3.2 and load problem od DL380G5 ?
Posted by Axb <ax...@gmail.com>.
On 04/03/2013 09:04 AM, Josef Karliak wrote:
> Good morning,
> we use SA on 8 CPUs HP DL380 G5. But sometimes spam daemon crash down :
> Apr 2 18:01:33 server systemd[1]: spamd.service: main process exited,
> code=exited, status=1
> Apr 2 18:01:33 server systemd[1]: Unit spamd.service entered failed state.
>
> In this time there were a high load (some user sent quite a lot of
> emails - about 800 ). In "/etc/sysconfig/spamd" I've startup arguments:
>
> SPAMD_ARGS="-d -c -L --max-children=40 --min-children=15
> --min-spare=5 -i 0.0.0.0 -A 192.168.67.1 -A 127.0.0.1"
>
> Is that OK ? Or what do you recommend ?
> Running on Opensuse 12.2 x64
do you really need --min-children=15 ?
bring it down to 5 and let us know what happens.
Running spamd in -D mode for a short period of high traffic may help you
find some other issues.