sare suggestions.

[Jo Rhett <jr...@netconsonance.com>]

ylan Bouterse wrote:
 > What SARE channels are you subscribing to? I just got the rules_du_jour
 > script running and added several SARE channels and I'm seeing SARE in my
 > amavisd log a LOT. Just wondering if there are certain hightly
 > recommended rule sets to use and those to stay away from that are too
 > strick and product false positives. Thanks for your feedback.

Please don't ask for offlist help.  Either everyone cares about the 
topic, or perhaps you shouldn't be mailing me anyway?

I don't use rulesdujour because it seems like too much hackery. 
sa-update (included with spamassassin) does it all very cleanly, and is 
supported by the team.  (sa-update is newer than rdj, so it's not really 
rdj's fault)

Frankly, I subscribed to almost every single ruleset on the 
rulesemporium page.  If I skipped any that weren't "do not use" then I 
don't know what they were.

-- 
Jo Rhett
Network/Software Engineer
Net Consonance

RE: sare suggestions.

[Dylan Bouterse <dy...@corp.power1.com>]

Thank you.

-----Original Message-----
From: Jo Rhett [mailto:jrhett@netconsonance.com] 
Sent: Tuesday, October 17, 2006 3:59 PM
To: Dylan Bouterse; list_spamassassin
Subject: sare suggestions.

ylan Bouterse wrote:
 > What SARE channels are you subscribing to? I just got the
rules_du_jour
 > script running and added several SARE channels and I'm seeing SARE in
my
 > amavisd log a LOT. Just wondering if there are certain hightly
 > recommended rule sets to use and those to stay away from that are too
 > strick and product false positives. Thanks for your feedback.

Please don't ask for offlist help.  Either everyone cares about the 
topic, or perhaps you shouldn't be mailing me anyway?

I don't use rulesdujour because it seems like too much hackery. 
sa-update (included with spamassassin) does it all very cleanly, and is 
supported by the team.  (sa-update is newer than rdj, so it's not really

rdj's fault)

Frankly, I subscribed to almost every single ruleset on the 
rulesemporium page.  If I skipped any that weren't "do not use" then I 
don't know what they were.

-- 
Jo Rhett
Network/Software Engineer
Net Consonance

Re: sare suggestions.

[Jo Rhett <jr...@netconsonance.com>]

On Oct 17, 2006, at 6:40 PM, R Lists06 wrote:
> I see... so 70 meg SA's when running all these ruleset is a good  
> general
> rule of thumb for size?

No, it's a single example.  I don't have enough systems with similar  
configs to make any generalized rule.

And FYI, those appear to be Amavis daemons, not SpamD daemons.  So if  
you're not using Amavis (which uses the SA object module) then YMWV  
(...will vary...)

-- 
Jo Rhett
Senior Network Engineer
Network Consonance

Re: sare suggestions.

[Jo Rhett <jr...@netconsonance.com>]

On Oct 17, 2006, at 7:46 PM, Bill Randle wrote:
> Seems to be. I run postfix + amavisd-new (with ClamAV and SA) and the
> res size runs around 68 MB. I'm using most, but not all, of the SARE
> rules. On this filter box, with 1 GB of memory, it is CPU bound. Dual
> 400 MHz Xeons and the load average runs around 7.5. Average of 60  
> msg/m
> of incoming mail (peak 370 msg/m). (This is without FuzzyOCR.)

You must be doing something else, because 2 400mhz processors should  
hold their own with my single 1.3ghz AMD chip.  And my mail load is  
easily 8x yours.  CPU utilization (if I'm not compiling something)  
ranges from 2-7%.  Load never breaks 0.

Amavisd, with amavisd-milter, clamd and all of the sare rulesets.   
But Bayes is disabled -- maybe that's the difference?

-- 
Jo Rhett
Senior Network Engineer
Network Consonance

RE: sare suggestions.

[Bill Randle <bi...@neocat.org>]

On Tue, 2006-10-17 at 18:40 -0700, R Lists06 wrote:
> > 
> > This is a personal colo box with very light load.  1gb of memory and
> > an AMD XP1800+ processor...  old, old technology.
> > 
> > The daemons are consistently around 70mb apiece, and there are
> > usually 5-7 running.  Low limit is 2, upper limit is 10.
> > 
> > Load average is always 0 across the board.  This system is bored.
> > 
> > --
> > Jo Rhett
> > Senior Network Engineer
> > Network Consonance
> > 
> 
> I see... so 70 meg SA's when running all these ruleset is a good general
> rule of thumb for size?
> 
>  - rh

Seems to be. I run postfix + amavisd-new (with ClamAV and SA) and the
res size runs around 68 MB. I'm using most, but not all, of the SARE
rules. On this filter box, with 1 GB of memory, it is CPU bound. Dual
400 MHz Xeons and the load average runs around 7.5. Average of 60 msg/m
of incoming mail (peak 370 msg/m). (This is without FuzzyOCR.)

	-Bill
 

RE: sare suggestions.

[R Lists06 <li...@abbacomm.net>]

> 
> This is a personal colo box with very light load.  1gb of memory and
> an AMD XP1800+ processor...  old, old technology.
> 
> The daemons are consistently around 70mb apiece, and there are
> usually 5-7 running.  Low limit is 2, upper limit is 10.
> 
> Load average is always 0 across the board.  This system is bored.
> 
> --
> Jo Rhett
> Senior Network Engineer
> Network Consonance
> 

I see... so 70 meg SA's when running all these ruleset is a good general
rule of thumb for size?

 - rh

Re: sare suggestions.

[Jo Rhett <jr...@netconsonance.com>]

On Oct 17, 2006, at 5:02 PM, R Lists06 wrote:
>> Frankly, I subscribed to almost every single ruleset on the
>> rulesemporium page.  If I skipped any that weren't "do not use"  
>> then I
>> don't know what they were.

> In this type of config, how much RAM are you running and how many
> processors??? Plus I am wondering how big are the SA processes that  
> are
> running in RAM with all those rulesets etc?

This is a personal colo box with very light load.  1gb of memory and  
an AMD XP1800+ processor...  old, old technology.

The daemons are consistently around 70mb apiece, and there are  
usually 5-7 running.  Low limit is 2, upper limit is 10.

Load average is always 0 across the board.  This system is bored.

-- 
Jo Rhett
Senior Network Engineer
Network Consonance

RE: sare suggestions.

[R Lists06 <li...@abbacomm.net>]

> 
> I don't use rulesdujour because it seems like too much hackery.
> sa-update (included with spamassassin) does it all very cleanly, and is
> supported by the team.  (sa-update is newer than rdj, so it's not really
> rdj's fault)
> 
> Frankly, I subscribed to almost every single ruleset on the
> rulesemporium page.  If I skipped any that weren't "do not use" then I
> don't know what they were.
> 
> --
> Jo Rhett
> Network/Software Engineer
> Net Consonance

Jo

In this type of config, how much RAM are you running and how many
processors??? Plus I am wondering how big are the SA processes that are
running in RAM with all those rulesets etc?

Thanks and kind regards

 - rh

--
Robert - Abba Communications
   Computer & Internet Services
 (509) 624-7159 - www.abbacomm.net