You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Ronald I. Nutter" <ro...@georgetowncollege.edu> on 2004/08/25 14:48:28 UTC
Questions about SA
I just finished getting SA up and running using the Scott L Henderson
document. It passes the tests in the documents. I don't see Spam
assassin running as a process like postfix and amavisd. Is there a way
to check that it is running ?
Also, what is suggested for hardware to run it on ? I will be dealing
with 1500 faculty/staff/students. I have it on a 400 mhz pentium with
32 megs of ram. I know I will need to add more memory before going to
production but wasn't sure about the processor.
Ron
--------------------------------------------------------------------
Ron Nutter ron_nutter@georgetowncollege.edu
Network Manager
Information Technology Services (502)863-7002
Georgetown College
Georgetown, KY 40324-1696
--------------------------------------------------------------------
-----Original Message-----
From: John Andersen [mailto:jsa@pen.homeip.net]
Sent: Wednesday, August 25, 2004 3:39 AM
To: spamassassin-users@incubator.apache.org
Subject: Re: [OT] Spam FIREWALL software
On Tuesday 24 August 2004 12:05 pm, Raquel Rice wrote:
> On Tue, 24 Aug 2004 15:00:14 -0400
>
> Matt Kettler <mk...@evi-inc.com> wrote:
> > Admittedly SA is tweakable to reduce FP's considerably, but being a
> > SA user the 1/25,000 FP rate doesn't choke me up at all. If it's
> > true, it's quite impressive. Very few spamfilters can claim a FP
> > rate anywhere near that low.
>
> The concern I have is what happens to false positives? They don't get
> past the firewall, so what if that's something important?
Ask yourself this: What happens to the "important" message just deleted
by the user in frustration of dealing with 300 spams per day? Or the
"important" message lost by a still too flaky smtp network.
My take on this is:
Who would send anything "important" by email without a follow-up or
confirmation of some kind?
If it was important then one should send a follow up or
request a return receipt.
--
_____________________________________
John Andersen
"(unknown)" errors in mail.log for user name when running spamd on
OS X
Posted by Rob Kudyba <rk...@raeinternet.com>.
If I start spamd as user 'bruce' it writes to the mail.log, (for example):
"(unknown):54". It correctly reports the number of the bruce account
but it doesn't pickup the name associated with it.
I tried this with several different accounts and with each one, it reports
(unknown):[user number].
Or for example, if I start as user "nobody": /usr/bin/spamd -u nobody -d
You'll see logs like this:
Aug 25 20:14:56 G518X2 spamd[6491]: logmsg: identified spam (13.4/5.0)
for (unknown):-2 in 0.3 seconds, 1482 bytes.
Aug 25 20:14:56 G518X2 spamd[6491]: identified spam (13.4/5.0) for
(unknown):-2 in 0.3 seconds, 1482 bytes.
Note that -2 is the user number in /etc/passwd by default. Not sure why
-2 is given as the user number either...
So, perhaps there's something wrong with the way spamd accesses the user
info on OS X?
I don't see anything regarding this problem on the
http://www.stupidfool.org/docs/sa.html page.
Re: Questions about SA
Posted by Kris Deugau <kd...@vianet.ca>.
"Ronald I. Nutter" wrote:
> Also, what is suggested for hardware to run it on ? I will be
> dealing with 1500 faculty/staff/students. I have it on a 400 mhz
> pentium with 32 megs of ram. I know I will need to add more memory
> before going to production but wasn't sure about the processor.
*cough* *splutter*
You're going to need a new box, unless you're expecting **VERY** low
per-user email volume. A P2/400 won't break a sweat just doing SMTP and
POP3 service for thousands of accounts; doing content filtering such as
SA on the same number of accounts pushes your processing requirements up
by something not far short of an order of magnitude.
I've got a P3/866/512M system with ~300 accounts, processing ~100K
messages/week- and while it's still got some headroom, it occasionally
bogs down if there's a spike in traffic. It had been a P2/450, which
was OK if the previous system in the relay chain (don't ask) kept a
fairly steady serialized stream of mail coming... but if the flow
increased even a little, processing bogged down and mail backed up.
On the conservative side, say each user receives 20 pieces of mail each
week. That's 30K messages per week.
But those accounts are going to start seeing spam, on the order of a
minimum of ~10 spams/day, after a few months. That's another 70
messages/week/account - 105K messages.
And that's a *very* low spam volume. Many accounts will probably see
50-100 spams daily within about 6 months - ~1M messages/week. Quite a
few will probably see up to 200/day. And a few will probably manage to
sign up for enough dodgy mailing lists to get their address far enough
out to see 300+ spams/day. :P Ugh.
For spamfiltering 1500 accounts, on a single box, I wouldn't go with
anything less than a dual P3/800/512M; given memory prices these days
I'd probably push that up to a gig. A fast disk system is also helpful.
-kgd
--
Get your mouse off of there! You don't know where that email has been!
[OT] Quoting Etiquette Re: Questions about SA
Posted by Matt Kettler <mk...@evi-inc.com>.
Mr Nutter,
May I ask why I've been quoted into this thread?
As I've asked you before, please don't hijack threads when creating a new
topic, but if you must, please at the VERY least remove the text of the
unrelated message.
I'm in general not too particular about details of trimming your quoting,
but clearly quoting an entire off-topic message is a waste and contributes
to confusion for people performing searches, filters, etc.
There's a lot of mail in my mailbox, and I have my mailclient set up to
track replies to my posts to make it easier to follow up with people I'm
helping. My mailclient spotted the portion of this email which quotes me,
and filtered it as something I need to follow up on.
At 08:48 AM 8/25/2004, Ronald I. Nutter wrote:
>I just finished getting SA up and running using the Scott L Henderson
>document. It passes the tests in the documents. I don't see Spam
>assassin running as a process like postfix and amavisd. Is there a way
>to check that it is running ?
>
>Also, what is suggested for hardware to run it on ? I will be dealing
>with 1500 faculty/staff/students. I have it on a 400 mhz pentium with
>32 megs of ram. I know I will need to add more memory before going to
>production but wasn't sure about the processor.
>
>Ron
>
>--------------------------------------------------------------------
>Ron Nutter ron_nutter@georgetowncollege.edu
>Network Manager
>Information Technology Services (502)863-7002
>Georgetown College
>Georgetown, KY 40324-1696
>--------------------------------------------------------------------
>
>
>-----Original Message-----
>From: John Andersen [mailto:jsa@pen.homeip.net]
>Sent: Wednesday, August 25, 2004 3:39 AM
>To: spamassassin-users@incubator.apache.org
>Subject: Re: [OT] Spam FIREWALL software
>
>
>On Tuesday 24 August 2004 12:05 pm, Raquel Rice wrote:
> > On Tue, 24 Aug 2004 15:00:14 -0400
> >
> > Matt Kettler <mk...@evi-inc.com> wrote:
> > > Admittedly SA is tweakable to reduce FP's considerably, but being a
> > > SA user the 1/25,000 FP rate doesn't choke me up at all. If it's
> > > true, it's quite impressive. Very few spamfilters can claim a FP
> > > rate anywhere near that low.
> >
> > The concern I have is what happens to false positives? They don't get
>
> > past the firewall, so what if that's something important?
>
>Ask yourself this: What happens to the "important" message just deleted
>by the user in frustration of dealing with 300 spams per day? Or the
>"important" message lost by a still too flaky smtp network.
>
>My take on this is:
>Who would send anything "important" by email without a follow-up or
>confirmation of some kind?
>
>If it was important then one should send a follow up or
>request a return receipt.
>
>
>--
>_____________________________________
>John Andersen