You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by up...@3.am on 2005/02/04 22:49:00 UTC
SA being overwhelmed?
Since upgrading to 3.02 from 2.63 and tweaking some rules, I've had
problems with smtp connections skyrocketing at times. I have raised the
limit (qmail-smtpd with tcpserver) to 400 connections so there would
always be an smtp connection available for legitimate relaying, but it
occasionally hits that, even though I've since implemented a patch to
tcpserver to limit external connections to 2 per IP at a time.
When it does hit this limit, a bunch of spam gets through with no markup
in the headers at all. I assume spamd simply gets overloaded (I have it
set to 15 children max to try to accomodate this huge load) and some spam
"spills out" unscanned.
If somebody has a pointer on how to best accomodate this, I'd appreciate
it.
James Smallacombe PlantageNet, Inc. CEO and Janitor
up@3.am http://3.am
=========================================================================
Re: SA being overwhelmed?
Posted by up...@3.am.
This is strange...you're quoting me, and the subject of an email I posted,
but the body of the message is somebody else's...I don't even run postfix,
I run qmail.
In any case, I seem to have alleviated the inundation for now. I was
running rblsmtpd against sbl-xbl.spamhaus.org, but I hadn't patched it to
recognize A records, only the default TXT. As soon as I applied the patch
and restarted tcpserver, most of the spam is now refused before SA has to
even deal with it.
A godsend!
On Sat, 5 Feb 2005, Thomas Arend wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Am Freitag, 4. Februar 2005 22:49 schrieb up@3.am:
>
> > It looks like spamassassin is trying to parse the Postfix master.cf
> > file. �
>
> Yes, it looks like.
>
> > The machine was running fine for several months. �This morning I
> > copied over some custom rules from the SARE site, but that was it, I
> > just copied them over. �Now SA is not flagging any mail. �Any
> > suggestions? �Our secondary mx box is picking up the load right now.
>
> Check your file system.
> Check the files in /etc/mail/spamassassin with grep.
>
> Check the copied files.
>
>
> Thomas
> >
> > Shane
>
> - --
> icq:133073900
> http://www.t-arend.de
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.0 (GNU/Linux)
>
> iD8DBQFCBIgcHe2ZLU3NgHsRAlDLAJ93tURWQkJYvok2xF1EINS47YNCywCfQMLy
> X/LQc5Uu09jDGqHvG6CueQk=
> =xk5P
> -----END PGP SIGNATURE-----
>
James Smallacombe PlantageNet, Inc. CEO and Janitor
up@3.am http://3.am
=========================================================================
Re: SA being overwhelmed?
Posted by Thomas Arend <ml...@arend-whv.info>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Am Freitag, 4. Februar 2005 22:49 schrieb up@3.am:
> It looks like spamassassin is trying to parse the Postfix master.cf
> file.
Yes, it looks like.
> The machine was running fine for several months. This morning I
> copied over some custom rules from the SARE site, but that was it, I
> just copied them over. Now SA is not flagging any mail. Any
> suggestions? Our secondary mx box is picking up the load right now.
Check your file system.
Check the files in /etc/mail/spamassassin with grep.
Check the copied files.
Thomas
>
> Shane
- --
icq:133073900
http://www.t-arend.de
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCBIgcHe2ZLU3NgHsRAlDLAJ93tURWQkJYvok2xF1EINS47YNCywCfQMLy
X/LQc5Uu09jDGqHvG6CueQk=
=xk5P
-----END PGP SIGNATURE-----