You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by ccrowley <cc...@tulane.edu> on 2006/10/18 20:33:07 UTC
Are other people seeing higher Load Averages after moving to 3.1.7?
All -
Just a quick inquiry. I updated from 3.1.3 to 3.1.7 yesterday. I'm seeing
substantially higher LA on the system. The system used to run at a range of
2.x - 8.x LA. With 3.1.7 I'm seeing 10.x - 50.x.
I'm in the process of reverting to see if the behavior persists or is
eliminated. But, I thought to check to see if anyone else has experienced
similar behavior?
--
View this message in context: http://www.nabble.com/Are-other-people-seeing-higher-Load-Averages-after-moving-to-3.1.7--tf2468623.html#a6882708
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Are other people seeing higher Load Averages after moving to 3.1.7?
Posted by Debbie D <we...@beautytech.com>.
"ccrowley" <cc...@tulane.edu> wrote in message
news:6882708.post@talk.nabble.com...
>
> All -
>
> Just a quick inquiry. I updated from 3.1.3 to 3.1.7 yesterday. I'm seeing
> substantially higher LA on the system. The system used to run at a range
> of
> 2.x - 8.x LA. With 3.1.7 I'm seeing 10.x - 50.x.
>
> I'm in the process of reverting to see if the behavior persists or is
> eliminated. But, I thought to check to see if anyone else has experienced
> similar behavior?
I have had the same problem.. I run EXIM, SA & ClamAV on my server and after
almost 2 weeks of constant baby sitting I found a rule that helped
tremendously to kill it as it hit the box..
In the exim.conf file, ACL section I added the deny dnslists command:
accept
condition = \
${lookup {${lc:$sender_address_domain}} partial-lsearch
{/etc/whitelist_senders} \
{yes} {${lookup {${lc:$sender_address}} lsearch
{/etc/whitelist_senders} \
{yes} {no} }} }
deny dnslists = blackholes.mail-abuse.org : \
dialups.mail-abuse.org
accept
dnslists = dsn.rfc-ignorant.org/$sender_address_domain
require
message = "This message is from a non-existant email address."
verify = sender/callout=defer_ok
accept
Since doing this little trick, I am consistently running under 1% loads and
the mail queue has stopping filling up. Immediately after that however yahoo
decided (probably because of the influx of spam to yahoo accounts from
server user accounts -- not enuf caffeine hope that made sense) decided to
delay all mail from the server to yahoo accounts. that has been a 3 day
battle which I believe is over now.. I freaked at first because I thought
this dnslists did that, so I removed it and saw the same 451 delay codes on
all yahoo mails in the queue, so decided it was not the cause.. the quantity
of spams reaching yahoo accounts must have been huge..
Re: Are other people seeing higher Load Averages after moving
to 3.1.7?
Posted by Steve Lake <st...@raiden.net>.
>>that My server has been taking between 400,000 and 500,000 messages per
>>day. A few months ago, it was more like 150,000 to 200,000 per day.
Yeah, we're getting hammered pretty badly here too. Rumor has it
that a spam war is going on. The spammers are trying to destroy or poison
every spam system out there with bunk spam so that when the real stuff
comes along that'll actually make them the real money, they'll be able to
slip it past with no problems. Give it time, keep on top of your SA setups
and this will soon pass and all that the spammers will have done is reveal
a bunch more tricks to us and reduce their quiver by a considerable
amount. Sure, sucks for us in the meantime, but in the end we still win. ^_^
Steven Lake
Owner/Technical Writer
Raiden's Realm
www.raiden.net
A friendly web community
Re: Are other people seeing higher Load Averages after moving to
3.1.7?
Posted by Michel R Vaillancourt <mi...@wolfstar.ca>.
Craig Baird wrote:
> I think spam is *way* up the last week or two. My server started
> hovering at
> a load average of around 55 a week or so ago. I started doing some
> investigating when I realized that the load was not coming down. I found
> that My server has been taking between 400,000 and 500,000 messages per
> day. A few months ago, it was more like 150,000 to 200,000 per day.
> Unfortunately,
> I moved logging over to a new syslog server recently, so I can't say
> whether
> the increase was sudden or gradual. I think some of it has been
> gradual, but
> it sure feels like it's only been the past few weeks that we've been
> getting
> hit *really* hard. After deciding that the load average was likely due to
> actual spam load, I implemented a couple of RBLs at the MTA level. My load
> is now back down between 1 and 3, and messages making it through to SA are
> now back to around 200,000 per day.
>
> Craig
>
Even my admittedly tiny shop has seen a 50% increase in traffic in the
past two weeks... from 10k messages a day to 15k - 16k average. Almost
100% of that increase is UCE.
--
--Michel Vaillancourt
Wolfstar Systems
www.wolfstar.ca
Re: Are other people seeing higher Load Averages after moving to
3.1.7?
Posted by Craig Baird <cr...@xpressweb.com>.
I think spam is *way* up the last week or two. My server started hovering at
a load average of around 55 a week or so ago. I started doing some
investigating when I realized that the load was not coming down. I found
that My server has been taking between 400,000 and 500,000 messages per
day. A few months ago, it was more like 150,000 to 200,000 per day.
Unfortunately,
I moved logging over to a new syslog server recently, so I can't say whether
the increase was sudden or gradual. I think some of it has been gradual, but
it sure feels like it's only been the past few weeks that we've been getting
hit *really* hard. After deciding that the load average was likely due to
actual spam load, I implemented a couple of RBLs at the MTA level. My load
is now back down between 1 and 3, and messages making it through to SA are
now back to around 200,000 per day.
Craig
Quoting ccrowley <cc...@tulane.edu>:
>
> I reverted to 3.1.3, and I still see the very high LA. So it does not appear
> to be a function of the upgrade. Probably just a lot of traffic.
>
>
>
> ccrowley wrote:
>>
>> All -
>>
>> Just a quick inquiry. I updated from 3.1.3 to 3.1.7 yesterday. I'm seeing
>> substantially higher LA on the system. The system used to run at a range
>> of 2.x - 8.x LA. With 3.1.7 I'm seeing 10.x - 50.x.
>>
>> I'm in the process of reverting to see if the behavior persists or is
>> eliminated. But, I thought to check to see if anyone else has experienced
>> similar behavior?
>>
>
> --
> View this message in context:
> http://www.nabble.com/Are-other-people-seeing-higher-Load-Averages-after-moving-to-3.1.7--tf2468623.html#a6883136
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>
>
Re: Are other people seeing higher Load Averages after moving to
3.1.7?
Posted by ccrowley <cc...@tulane.edu>.
I reverted to 3.1.3, and I still see the very high LA. So it does not appear
to be a function of the upgrade. Probably just a lot of traffic.
ccrowley wrote:
>
> All -
>
> Just a quick inquiry. I updated from 3.1.3 to 3.1.7 yesterday. I'm seeing
> substantially higher LA on the system. The system used to run at a range
> of 2.x - 8.x LA. With 3.1.7 I'm seeing 10.x - 50.x.
>
> I'm in the process of reverting to see if the behavior persists or is
> eliminated. But, I thought to check to see if anyone else has experienced
> similar behavior?
>
--
View this message in context: http://www.nabble.com/Are-other-people-seeing-higher-Load-Averages-after-moving-to-3.1.7--tf2468623.html#a6883136
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.