You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by DNI Support Department <su...@dynamicnet.net> on 2005/03/11 14:57:16 UTC
Is it possible to use SURBL without enabling all network tests?
Greetings:
If we disable network tests by using "--local" in our start up of spamd,
spam assassin averages 0.1 to 0.3 seconds per email to process its rules.
If we enable network tests, then spam assassin averages 11 to 15 seconds
per email to process its rules.
Of all the network tests, we find SURBL -- http://www.surbl.org/ -- to be
the most productive.
Is there a way to enable network tests for just SURBL (we have a local,
kept up to date with rsync, copy)?
Thank you.
________________________________________________
Peter M. Abraham
Support and Customer Care Department
Dynamic Net, Inc.
Helping companies do business on the Net
420 Park Road; Suite 201
Wyomissing PA 19610
Toll Free Voice: 1-888-887-6727
International: 1-610-736-3795
FAX: 1-610-736-3798
Support Email: support@dynamicnet.net
Company Email: solutions@dynamicnet.net
Web: http://www.dynamicnet.net/
http://www.wemanageservers.com/
________________________________________________
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Jeff Chan <je...@surbl.org>.
A friend who wishes to remain anonymous forwarded me this patch
and note:
> Jeff, Saw the thread on sa-users list about using SURBL without other
> networks
>
> Attached is a ugly patch which I think might do the trick.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Jeff Chan <je...@surbl.org>.
On Friday, March 11, 2005, 9:53:19 AM, DNI Department wrote:
> Greetings:
> SURBL does not appear to work with network tests totally disabled (i.e.
> using --local in the spamd startup).
It may be worth noting that disabling network tests at the
command line with --local and "skip_rbl_checks 1" inside
the configs may not produce the same results. The former may
disable all network tests (including Razor, DCC, RBLs, SURBLs,
etc.), while the latter may disable only RBL checks.
Also Stuart Johnston's comment about the scoring being affected
by having network tests disabled is important. IIRC there is
a matrix of 4 possible scores, with and without Bayes and with
and without network tests.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Jeff Chan <je...@surbl.org>.
On Friday, March 11, 2005, 9:57:45 AM, Martin Hepworth wrote:
> Are you running a caching name server locally on the machine? This helps
> alot in reducing the DNS traffic for RBLs and URI RBL's.
> I normally process emails in under 2 seconds using couple of RBL's,
> pyzor and all of the subl.org URI lookups.
I believe they are using rsynced local zone files. (I'm hoping
they're using rbldnsd since it's so much faster and more
efficient than BIND.)
http://www3.surbl.org/rsync-signup.html
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Jeff Chan <je...@surbl.org>.
On Friday, March 11, 2005, 11:31:34 AM, DNI Department wrote:
> We have rbldnsd running of a private IP with BIND/DNS forwarding calls to
> the various SURBL lists to that name server. We are approved to rsync the
> data from surbl; and that's been working well.
> Our primary mail server is on a physical server running several network
> applications besides mail; we will be moving it to its own physical server
> in a few months; hopefully then we can match your under 2 second benchmark.
Sounds good. :-)
> On a side note, we are a paid spamcop.net subscriber; and we do report all
> spam to spamcop (under 8 hour average reporting time); so we do what we can
> to prevent spam in the first place.
Definitely use SpamCop. SpamCop reports go into their RBL, and
the spamvertised sites detected in spam message body URIs go into
sc.surbl.org, where they're highly effective at detecting future
pam.
I would definitely encourage everyone to use SpamCop.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Is it possible to use SURBL without enabling all network
tests?
Posted by DNI Support Department <su...@dynamicnet.net>.
Greetings Martin:
We have rbldnsd running of a private IP with BIND/DNS forwarding calls to
the various SURBL lists to that name server. We are approved to rsync the
data from surbl; and that's been working well.
Our primary mail server is on a physical server running several network
applications besides mail; we will be moving it to its own physical server
in a few months; hopefully then we can match your under 2 second benchmark.
On a side note, we are a paid spamcop.net subscriber; and we do report all
spam to spamcop (under 8 hour average reporting time); so we do what we can
to prevent spam in the first place.
Thank you.
At 12:57 PM 3/11/2005, you wrote:
>Are you running a caching name server locally on the machine? This helps
>alot in reducing the DNS traffic for RBLs and URI RBL's.
>
>I normally process emails in under 2 seconds using couple of RBL's, pyzor
>and all of the subl.org URI lookups.
>
>--
>Martin Hepworth
>Snr Systems Administrator
>Solid State Logic
>Tel: +44 (0)1865 842300
________________________________________________
Peter M. Abraham
Support and Customer Care Department
Dynamic Net, Inc.
Helping companies do business on the Net
420 Park Road; Suite 201
Wyomissing PA 19610
Toll Free Voice: 1-888-887-6727
International: 1-610-736-3795
FAX: 1-610-736-3798
Support Email: support@dynamicnet.net
Company Email: solutions@dynamicnet.net
Web: http://www.dynamicnet.net/
http://www.wemanageservers.com/
________________________________________________
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Martin Hepworth <ma...@solid-state-logic.com>.
Are you running a caching name server locally on the machine? This helps
alot in reducing the DNS traffic for RBLs and URI RBL's.
I normally process emails in under 2 seconds using couple of RBL's,
pyzor and all of the subl.org URI lookups.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
DNI Support Department wrote:
> Greetings:
>
> SURBL does not appear to work with network tests totally disabled (i.e.
> using --local in the spamd startup).
>
> No network tests:
>
> 0.1 to 0.6 seconds to score emails as spam or ham
> Approximately 90% accuracy on tagging spam correctly
> Approximately 2% false positives tagging ham as spam
>
> Network tests (for SURBL)
> 11.0 to over 16 seconds to score emails as spam or ham
> Approximately 95% accuracy on tagging spam correctly
> Approximately 1 to 2% false positives tagging ham as spam
>
> Thanks to input from this mailing list, we've disabled almost all of the
> network tests.
>
> This has helped tremendously brining the scoring time down to an average
> of 3 to 4 seconds per email with the range of times from 0.4 seconds to
> 8 seconds.
>
> Thank you.
>
> At 12:40 PM 3/11/2005, you wrote:
>
>> On Friday, March 11, 2005, 9:34:15 AM, Stuart Johnston wrote:
>> > DNI Support Department wrote:
>> >>
>> >> Is there a way to enable network tests for just SURBL (we have a
>> local,
>> >> kept up to date with rsync, copy)?
>>
>> > One possible problem with doing this is that it will switch you to the
>> > network score sets giving you lower scores for other tests. Without
>> the
>> > other network tests to balance things out, you may end up with lower
>> > scores overall.
>>
>> Or you could boost the SURBL scores, or lower your spam
>> threshold. :-)
>>
>> Jeff C.
>> --
>> Jeff Chan
>> mailto:jeffc@surbl.org
>> http://www.surbl.org/
>
>
> ________________________________________________
> Peter M. Abraham
> Support and Customer Care Department
> Dynamic Net, Inc.
> Helping companies do business on the Net
> 420 Park Road; Suite 201
> Wyomissing PA 19610
> Toll Free Voice: 1-888-887-6727
> International: 1-610-736-3795
> FAX: 1-610-736-3798
> Support Email: support@dynamicnet.net
> Company Email: solutions@dynamicnet.net
> Web: http://www.dynamicnet.net/
> http://www.wemanageservers.com/
> ________________________________________________
>
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
Re: Is it possible to use SURBL without enabling all network
tests?
Posted by DNI Support Department <su...@dynamicnet.net>.
Greetings:
SURBL does not appear to work with network tests totally disabled (i.e.
using --local in the spamd startup).
No network tests:
0.1 to 0.6 seconds to score emails as spam or ham
Approximately 90% accuracy on tagging spam correctly
Approximately 2% false positives tagging ham as spam
Network tests (for SURBL)
11.0 to over 16 seconds to score emails as spam or ham
Approximately 95% accuracy on tagging spam correctly
Approximately 1 to 2% false positives tagging ham as spam
Thanks to input from this mailing list, we've disabled almost all of the
network tests.
This has helped tremendously brining the scoring time down to an average of
3 to 4 seconds per email with the range of times from 0.4 seconds to 8 seconds.
Thank you.
At 12:40 PM 3/11/2005, you wrote:
>On Friday, March 11, 2005, 9:34:15 AM, Stuart Johnston wrote:
> > DNI Support Department wrote:
> >>
> >> Is there a way to enable network tests for just SURBL (we have a local,
> >> kept up to date with rsync, copy)?
>
> > One possible problem with doing this is that it will switch you to the
> > network score sets giving you lower scores for other tests. Without the
> > other network tests to balance things out, you may end up with lower
> > scores overall.
>
>Or you could boost the SURBL scores, or lower your spam
>threshold. :-)
>
>Jeff C.
>--
>Jeff Chan
>mailto:jeffc@surbl.org
>http://www.surbl.org/
________________________________________________
Peter M. Abraham
Support and Customer Care Department
Dynamic Net, Inc.
Helping companies do business on the Net
420 Park Road; Suite 201
Wyomissing PA 19610
Toll Free Voice: 1-888-887-6727
International: 1-610-736-3795
FAX: 1-610-736-3798
Support Email: support@dynamicnet.net
Company Email: solutions@dynamicnet.net
Web: http://www.dynamicnet.net/
http://www.wemanageservers.com/
________________________________________________
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Jeff Chan <je...@surbl.org>.
On Friday, March 11, 2005, 9:34:15 AM, Stuart Johnston wrote:
> DNI Support Department wrote:
>>
>> Is there a way to enable network tests for just SURBL (we have a local,
>> kept up to date with rsync, copy)?
> One possible problem with doing this is that it will switch you to the
> network score sets giving you lower scores for other tests. Without the
> other network tests to balance things out, you may end up with lower
> scores overall.
Or you could boost the SURBL scores, or lower your spam
threshold. :-)
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Stuart Johnston <st...@ebby.com>.
DNI Support Department wrote:
>
> Is there a way to enable network tests for just SURBL (we have a local,
> kept up to date with rsync, copy)?
One possible problem with doing this is that it will switch you to the
network score sets giving you lower scores for other tests. Without the
other network tests to balance things out, you may end up with lower
scores overall.
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Jeff Chan <je...@surbl.org>.
On Friday, March 11, 2005, 7:51:45 AM, Jeff Chan wrote:
> On Friday, March 11, 2005, 7:48:26 AM, Vivek Khera wrote:
>> in your preferences file,
>> skip_rbl_checks 1
>> will turn off the RBL checks but leave SURBL checks on.
>> Vivek Khera, Ph.D.
>> +1-301-869-4449 x806
> Hmm, but is that a good thing or an inconsistency? In any case
> setting the scores of the regular RBL checks to 0 will definitely
> do the right thing, and is arguably safer.
I.e., in terms of networking the DNS queries, shouldn't SURBLs
and RBLs be handled similarly? The actual DNS lookups against
the lists are pretty similar, aside from the lack of needing to
resolve the wild domains into IPs first when using SURBLs.
(This is a question for the developers really. :-)
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Jeff Chan <je...@surbl.org>.
On Friday, March 11, 2005, 7:48:26 AM, Vivek Khera wrote:
> On Mar 11, 2005, at 8:57 AM, DNI Support Department wrote:
>> Is there a way to enable network tests for just SURBL (we have a
>> local, kept up to date with rsync, copy)?
>>
> in your preferences file,
> skip_rbl_checks 1
> will turn off the RBL checks but leave SURBL checks on.
> Vivek Khera, Ph.D.
> +1-301-869-4449 x806
Hmm, but is that a good thing or an inconsistency? In any case
setting the scores of the regular RBL checks to 0 will definitely
do the right thing, and is arguably safer.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Vivek Khera <vi...@khera.org>.
On Mar 11, 2005, at 8:57 AM, DNI Support Department wrote:
> Is there a way to enable network tests for just SURBL (we have a
> local, kept up to date with rsync, copy)?
>
in your preferences file,
skip_rbl_checks 1
will turn off the RBL checks but leave SURBL checks on.
Vivek Khera, Ph.D.
+1-301-869-4449 x806
Re: Is it possible to use SURBL without enabling all network tests?
Posted by Raymond Dijkxhoorn <ra...@prolocation.net>.
Hi!
> If we disable network tests by using "--local" in our start up of spamd, spam
> assassin averages 0.1 to 0.3 seconds per email to process its rules.
>
> If we enable network tests, then spam assassin averages 11 to 15 seconds per
> email to process its rules.
>
> Of all the network tests, we find SURBL -- http://www.surbl.org/ -- to be the
> most productive.
>
> Is there a way to enable network tests for just SURBL (we have a local, kept
> up to date with rsync, copy)?
You can score the other lookups at 0, so they will be skipped.
Bye,
Raymond.