sa-blacklist

[Robert Fitzpatrick <li...@webtent.net>]

Having process load issues, I found that removing my two sa-blacklist
rules took care of it. If fact, very good processing times now that
they're gone. My question is, what I'm I missing? Spam filtering is
doing a fine job since changes applied 24 hours ago.

I run Postfix 2.2.8 with amavisd-new 2.3.3 that hands off to SA. The
server is FreeBSD 5.4 with dual P4 processors with hyperthreading
enabled and a gig of RAM using RAID5. My postfix/amavisd setup is using
4 processes at a time. I tried bumping this to 10 and my server will
begin even hesitating on the shell prompt. This setup with 4 has run for
a while very well, but then I added these sa-blacklist rules. Also, is
hyperthreading a good thing?

-- 
Robert

Re: installing custom rulesets from rulesemporium

[Rick Macdougall <ri...@ummm-beer.com>]

Sergei Gerasenko wrote:
> I just downloaded antidrug.cf from drugemporium and dropped it in the
> rules directory. spamassassin -D says that it's reading it but running a
> "drug" message through doesn't trigger the rules. Should I rename
> antidrug.cf to say 35_antidrug.cf or it doesn't matter? Is there anyway
> I can test the ruleset?
> 
> Also turns out I was missing libnet-dns-perl and if you remember I said
> that a message got through unmarked, well, I after I installed that
> module, the score went from 0.5 to 16 on the same message -- which is
> very cool. 

Did you restart spamd after adding the rules ?

Regards,

Rick

installing custom rulesets from rulesemporium

[Sergei Gerasenko <ge...@publicschoolworks.com>]

I just downloaded antidrug.cf from drugemporium and dropped it in the
rules directory. spamassassin -D says that it's reading it but running a
"drug" message through doesn't trigger the rules. Should I rename
antidrug.cf to say 35_antidrug.cf or it doesn't matter? Is there anyway
I can test the ruleset?

Also turns out I was missing libnet-dns-perl and if you remember I said
that a message got through unmarked, well, I after I installed that
module, the score went from 0.5 to 16 on the same message -- which is
very cool. 

Re: sa-blacklist

[Matt Kettler <mk...@comcast.net>]

Robert Fitzpatrick wrote:
> Having process load issues, I found that removing my two sa-blacklist
> rules took care of it. If fact, very good processing times now that
> they're gone. My question is, what I'm I missing? Spam filtering is
> doing a fine job since changes applied 24 hours ago.
>   
sa-blacklist is a large file, and consumes a LOT of memory and a
reasonably large amount of processing time too.
> I run Postfix 2.2.8 with amavisd-new 2.3.3 that hands off to SA. The
> server is FreeBSD 5.4 with dual P4 processors with hyperthreading
> enabled and a gig of RAM using RAID5. My postfix/amavisd setup is using
> 4 processes at a time. I tried bumping this to 10 and my server will
> begin even hesitating on the shell prompt. 

How much free memory did you have when you were at 4 processes? How much
when you had 10?

I suspect when you were running with 10 you were going deep into your
swapfile.

Always double-check your free memory using "free" or "top" before increasing

> This setup with 4 has run for
> a while very well, but then I added these sa-blacklist rules. 
So don't add them... IMHO they're not nearly as useful as they are
wasteful. If you've got tons of resources (>3gig of ram >9ghz total cpu)
it's probably worth it, but if not you need to test and see how well it
works.
> Also, is
> hyperthreading a good thing?
>   
Sometimes, but not always.

In some cases it can improve performance, but the Intel benchmarks
showing 60% performance improvement are heavily tuned to perform best
under HT. They're also avoiding the situations where HT actually impairs
performance.

 The typical system sees somewhere between +20 and -15% performance
improvement (note that -15% improvement is a detriment) depending on
workload. Servers with large numbers of simultaneous processes all
working at once tend to see the better end of that. Workstations
grinding the heck out of the CPU with a single thread tend to be at the
worst end of that.

Take a look at:
http://www.2cpu.com/articles/41_1.html

For some examples of workloads that benefit (apache and mysql) and
suffer (bladenc, kernel compiles, java VolanoMark) from the use of HT.

With SA, you'll probably see benefit whenever there's more than (# of
physical cpus) instances of SA actually processing mail at the same
time. You'll probably see lower performance in the single-message-at-a
time case. However, given that the single-message case reflects low-load
times for your server, that should be OK, provided the high load end
gets a good boost.