Jdow wrote:
>Steve, it might help if you listed which rule sets. There are some
>which are obscenely large and others that are obsolete. Maybe we
>can prune the list for you a little.
As some have mentioned I may have too many rules. I would like to know
what is a must have and what I should not use. Here is a list of what
is currently in the /etc/mail/spamassassin/ folder:
CURRENTLY IN /ETC/MAIL/SPAMASSASSIN
70_sare_adult.cf
70_sare_bayes_poison_nxm.cf
70_sare_evilnum0.cf
occa_phishing.cf
occa_replica.cf
sa-blacklist.cf
sa-blacklist.current.uri.cf
tripwire.cf
chickenpox.cf
init.pre
random.cf
random.current.cf
weeds2.cf
local.cf
The rules below were moved yesterday and placed in a different folder.
Once I moved these and restarted spamassassin by rebooting the server it
was no longer bogging down and duplicating emails.
REMOVED YESTERDAY FROM /ETC/MAIL/SPAMASSASSIN
70_sare_evilnum1.cf
70_sare_evilnum2.cf
70_sare_header0.cf
70_sare_header.cf
70_sare_header_eng.cf
70_sare_html0.cf
70_sare_html1.cf
70_sare_html2.cf
70_sare_html3.cf
70_sare_html4.cf
70_sare_html_eng.cf
70_sare_oem.cf
70_sare_random.cf
70_sare_ratware.cf
70_sare_specfic.cf
70_sare_uri0.cf
70_sare_uri.cf
70_sare_whitlelist.cf
70_sare_whitelist_pre30.cf
72_sare_bml_post23x.cf
99_sare_fraud_post25x.cf
antidrug.cf
blacklist.cf
blacklist-uri.cf
bogus-virus-warnings.cf
Here is the content of my config file for rules_du_jour:
TRUSTED_RULESETS="TRIPWIRE ANTIDRUG SARE_EVILNUMBERS0 BLACKLIST
BLACKLIST_URI RANDOMVAL BOGUSVIRUS SARE_ADULT SARE_FRAUD
SARE_BAYES_POISON_NXM SARE_OEM SARE_RANDOM SARE_HEADER SARE_HEADER0
SARE_HEADER_ENG SARE_HTML0 SARE_HTML1 SARE_HTML2 SARE_HTML3 SARE_HTML4
SARE_HTML_ENG SARE_RATWARE SARE_SPECIFIC SARE_URI SARE_BML_POST25X
SARE_WHITELIST SARE_WHITELIST_PRE30"
SA_DIR="/etc/mail/spamassassin"
MAIL_ADDRESS="[EMAIL PROTECTED]"
SA_RESTART="killall -HUP spamd"
I have quite a few users who get a lot of spam, especially
pharmaceuticals and stocks delivered to their mailboxes. They are why I
began trying to work on the spamassassin filtering. An interesting note
I have observed but do not understand why it is happening. When I
updated the rules on Monday, many users started seeing an increase
number of spam in their mailboxes. One user who was getting a great
deal of duplicate emails was also seeing a huge increase in the total
numbers of spam emails. Where she would receive 100 spam emails per day
before the rules_du_jour update, afterwards she was seeing 800 or 900
spam emails per day. Much of it was porn spam that she was not seeing
before the update to the rules files.
I would appreciate any advice and/or education offered on the spam
filtering.
Thanks,
Steve Ingraham
{^_^}
----- Original Message -----
From: "Steve Ingraham" <[EMAIL PROTECTED]>
Steve Ingraham wrote:
I need help with a problem. Our users are seeing some multiple
duplicate emails coming from the same sender. This is not occurring
with every email so there does not seem to be any pattern to which
incoming emails will be duplicated and which ones won't. They are also
reporting that duplicate emails are sent when they send to an outside
email. Has anyone experienced this problem before? What could be
causing this to occur and what can I do to stop this? I am running
qmailtoaster and spamassassin as an external email gateway. There has
been nothing changed with qmail but I did update some rules in SA using
rules_du_jour yesterday. Would these rules updates cause this problem?
If so, what would have changed?
Jake Vickers wrote:
If your system is low on resources (ie: RAM), then the spamd process can
take too long, making Toaster think the mail got lost somewhere, so it
resends it.
Might want to check and see how much RAM you're using.
I want to thank everyone who posted a reply on my inquiry. I believe
Jake Vickers was right about the problem. The RAM on the email server
was bogged down since yesterday when I updated the various .cf files
using rules_du_jour. I had included just a handful of rules from RDJ
but it appears that RDJ utilizes much too much of my server resources to
use it to update my spamassassin rules. It was slowing down the server
so much that simple functions were not responding. This appears to have
affected the delivery of emails. In fact I noticed that my original
message to these mail lists took several hours to post and were
duplicated also. I resolved the problem by moving the various rules .cf
files out of the /etc/mail/spamassassin folder and restarting
spamassassin.
If anyone has a simple way of updating rules for spamassassin I would
welcome your input. I still need to update the rules as I have been
getting a great number of emails coming through to users. Specifically,
we are getting a lot of the pharmaceutical spam and the stock spam.
Again, thanks to everyone for the posts.
Steve Ingraham
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
