I am not sure which Imail release included the log anylizer, 8.1 I think, if
you have that version you can run the anylizer on your declude log files and
just select "unknown log lines" It is a dirty way to do it but it gives you
the info you are looking for
Rick Davidson
National Systems Manager
North American Title Group
-
----- Original Message -----
From: "Scott Fisher" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 17, 2004 1:19 PM
Subject: Re: [Declude.JunkMail] Declude and attachments
I haven't found any easy way to tell. The information is in the logs at high
level.
But I can chime in that SKIPIFWEIGHT bypasses about 80% of my e-mail that is
obviously spam. TESTSFAILED ENDS for "friendly domains/revdns" drop off
about 8% of e-mail that is most likely not spam, leaving about 12% of the
e-mail that I run body filters on.
Scott Fisher
Director of IT
Farm Progress Companies
>>> [EMAIL PROTECTED] 06/17/04 12:03PM >>>
Matt-
My body filters only catch about 4% of messages, but I don't know how often
they are run. Is htere a convenient way to tell?
-d
----- Original Message -----
From: "Matt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 17, 2004 12:40 PM
Subject: Re: [Declude.JunkMail] Declude and attachments
> Scott,
>
> I've got a lot more BODY filters than Dave has, though I don't feel that
> they are excessive. I probably have about 1,500 BODY searches, but with
> SKIPIFWEIGHT they only run about 25% of the time.
>
> If Dave is using Declude Virus, I would also look there for the issue.
> Anything besides F-Prot and ClamAV in daemon mode will chug a server on
> a large attachment and it will use up far more processing than Declude
> JunkMail, but it will keep the Declude instance alive for longer. On
> about 65,000 messages a day currently, we generally see from 2 to 10
> Declude processes running at one time with both F-Prot and AVG enabled
> (much less with just F-Prot). Disabling AVG results in our average
> processor utilization dropping by 1/3 to 1/2 on heavy load hours.
>
> Matt
>
>
>
> R. Scott Perry wrote:
>
> >
> >> One instance of Declude, then two, then three, all in the 25%+ range.
As
> >> soon as it dropped to two Decludes, Queue Manager came right in at
> >> 30-40%,
> >> then the cycles dropped as QueueManager dropped down.
> >
> >
> > It does sound like it is the large files that are causing the problem.
> >
> > One option would be to temporarily disable the BODY filter with the
> > 200 lines in it, to see if that prevents the problem with the high CPU
> > usage in Declude JunkMail. That could indeed be causing the problem.
> >
> > The other would be to use the debug mode ("LOGLEVEL DEBUG" in the
> > \IMail\Declude\global.cfg file) and waiting for one of these files to
> > be sent. We can look at the debug log file entries to get a better
> > idea of where the high CPU usage is occurring.
> >
> > -Scott
> > ---
> > Declude JunkMail: The advanced anti-spam solution for IMail
> > mailservers since 2000.
> > Declude Virus: Ultra reliable virus detection and the leader in
> > mailserver vulnerability detection.
> > Find out what you've been missing: Ask for a free 30-day evaluation.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list. To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail". The archives can be found
> > at http://www.mail-archive.com.
> >
> >
>
> --
> =====================================================
> MailPure custom filters for Declude JunkMail Pro.
> http://www.mailpure.com/software/
> =====================================================
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
