Re: [Declude.JunkMail] Setting MAX Testing Weight
I thought the essence of the argument against this is the fact that such testing doesn't happen one at a time, but instead in unison with one another. So if 20 queries are sent out and the first 10 that come back to put the score high enough to fail, there isn't really that much overhead in waiting for the remaining 10 to come back considering that they have already been queried. I'm not sure exactly how the application handles the technical tests, but it would seem that many of them are done in unison as opposed to independent of one another just like the DNS-based tests. HELOBOGUS, SPAMHEADERS and BADHEADERS for instance all look at the same pieces of information, so it's probably not something that can be separated into individually triggered tests. I would think that by the time you caught a high enough score, the majority of the processing would already be finished and you would only be waiting on the remaining DNS queries to come back. Another issue is that score handling is only marked in the $default$.junkmail files, and you can have different settings for each domain and user depending on your version, yet there is only one global.config file that gets used for every user on a system. So knowing what score to stop on becomes overhead since the system doesn't need to keep track of handling information during testing as things stand, and beyond that a logic mess for a programmer. I guess that while what you suggest would be nice in some circumstances, it might not be practical programmatically??? I'm also going to guess that some of the newer tests that involve opening, parsing and execution of files like SPAMDOMAINS and SPAMCHECK would have a noticeable impact on the processor cycles needed, and that might be why you are seeing the increase that you are. Some DNS-based tests might also be slow in responding, and might also rarely return a match, in which case it would make sense to remove them if you are worried about processing time. I'm no expert on the details, but that's what makes sense from what I think I know :) Matt Todd - Smart Mail wrote: I brought this up last week.Anyone see the benefit beside me? The idea of being able to stop testing once a given Weight has been reached seems to have multiple benefits to me.My numbers indicate that about 45% of my spam would benefitfrom stopping testing at 4X my Hold Weight. I know that Declude is not a resource hog but my Decludetests have increased dramatically over the past couple months and I don't see them getting any less in the future. I've Added 2 x Subjectspaces Spamdomains 4 x Comments Spamcheck And a host of DNS tests. That's my CPU, Bandwidth, and other resources. Andas more and more people move to spam prevention it seems the DNS Blacklists will get more use. I guess my point is why continue to test and use resourcesonce you reach a certain point where you're3X,4Xor 5Xyour hold weight? Any thoughts? Todd Hunter Progressive Systems - Original Message - From: Todd - Smart Mail To: [EMAIL PROTECTED] Sent: Thursday, August 28, 2003 10:04 AM Subject: Re: [Declude.JunkMail] Setting MAX Testing Weight John, As I mentioned, the order that you ran the tests would affect the outcome. Tests that generate a negative weight would need to be run first, such as IPNOTINMX, BONDEDSENDER, and other whitelist type of tests. Also the reason I suggested stopping testing at weigh 3x my HOLD weight. This gives some margin where test would continue to run. Todd - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Thursday, August 28, 2003 9:36 AM Subject: RE: [Declude.JunkMail] Setting MAX Testing Weight You do not want Declude to stop at a certain point. What if it stops, right before the next test which is a whitefilter type test? With the weighting system, it is important to run all tests to get the final weight. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Todd - Smart Mail Sent: Thursday, August 28, 2003 12:34 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Setting MAX Testing Weight My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. SayI have40 testsand after Declude runsthe first 10 of themit accumulates ascore of 300.IHOLD at 100.Further testing beyond 300uses additional resources to produce the same outcome with no additional benefits. Resources including
Re: [Declude.JunkMail] Setting MAX Testing Weight
As was mentioned here before, it's not a BAD idea to want Declude to stop after X has been reached, but, what if the whitelist came right after that X number? Scott, are there any plans to, or can Declude already, run the Whitelist tests FIRST, so that if they are whitelisted, forgoes any weight testing alltogether? I think that would be beneficial in this case. If we list the whitelist tests first, will they be run first? Paul - Original Message - From: Todd - Smart Mail To: [EMAIL PROTECTED] Sent: Tuesday, September 02, 2003 10:27 PM Subject: Re: [Declude.JunkMail] Setting MAX Testing Weight I brought this up last week.Anyone see the benefit beside me? The idea of being able to stop testing once a given Weight has been reached seems to have multiple benefits to me.My numbers indicate that about 45% of my spam would benefitfrom stopping testing at 4X my Hold Weight. I know that Declude is not a resource hog but my Decludetests have increased dramatically over the past couple months and I don't see them getting any less in the future. I've Added 2 x Subjectspaces Spamdomains 4 x Comments Spamcheck And a host of DNS tests. That's my CPU, Bandwidth, and other resources. Andas more and more people move to spam prevention it seems the DNS Blacklists will get more use. I guess my point is why continue to test and use resourcesonce you reach a certain point where you're3X,4Xor 5Xyour hold weight? Any thoughts? Todd Hunter Progressive Systems
Re: [Declude.JunkMail] Setting MAX Testing Weight
Scott, are there any plans to, or can Declude already, run the Whitelist tests FIRST, so that if they are whitelisted, forgoes any weight testing alltogether? I think that would be beneficial in this case. If we list the whitelist tests first, will they be run first? There is a new PREWHITELIST ON option that will run some of the whitelists before the tests are run. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Setting MAX Testing Weight
There is a new PREWHITELIST ON option that will run some of the whitelists before the tests are run. Can you explain the some part? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Setting MAX Testing Weight
There is a new PREWHITELIST ON option that will run some of the whitelists before the tests are run. Can you explain the some part? It currently just does the WHITELIST FROM and WHITELIST IP whitelist entries before running the spam tests. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Setting MAX Testing Weight
I brought this up last week.Anyone see the benefit beside me? The idea of being able to stop testing once a given Weight has been reached seems to have multiple benefits to me.My numbers indicate that about 45% of my spam would benefitfrom stopping testing at 4X my Hold Weight. I know that Declude is not a resource hog but my Decludetests have increased dramatically over the past couple months and I don't see them getting any less in the future. I've Added 2 x Subjectspaces Spamdomains 4 x Comments Spamcheck And a host of DNS tests. That's my CPU, Bandwidth, and other resources. Andas more and more people move to spam prevention it seems the DNS Blacklists will get more use. I guess my point is why continue to test and use resourcesonce you reach a certain point where you're3X,4Xor 5Xyour hold weight? Any thoughts? Todd Hunter Progressive Systems - Original Message - From: Todd - Smart Mail To: [EMAIL PROTECTED] Sent: Thursday, August 28, 2003 10:04 AM Subject: Re: [Declude.JunkMail] Setting MAX Testing Weight John, As I mentioned, the order that you ran the tests would affect the outcome. Tests that generate a negative weight would need to be run first, such as IPNOTINMX, BONDEDSENDER, and other whitelist type of tests. Also the reason I suggested stopping testing at weigh 3x my HOLD weight. This gives some margin where test would continue to run. Todd - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Thursday, August 28, 2003 9:36 AM Subject: RE: [Declude.JunkMail] Setting MAX Testing Weight You do not want Declude to stop at a certain point. What if it stops, right before the next test which is a whitefilter type test? With the weighting system, it is important to run all tests to get the final weight. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd - Smart MailSent: Thursday, August 28, 2003 12:34 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Setting MAX Testing Weight My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. SayI have40 testsand after Declude runsthe first 10 of themit accumulates ascore of 300.IHOLD at 100.Further testing beyond 300uses additional resources to produce the same outcome with no additional benefits. Resources including processing, bandwidth, and un-needed additional queries to blacklist servers that are working hard tomaintain their services. In this scenario the order that Declude ran your tests would be a factor. You could place your tests in a specific order in the Declude configso that primacy tests like Spamcop were first, andadditional tests would onlybe run if needed. Or you couldrun tests like Spamcheck,Badheaders, Helobogus first and be able to HOLD messages with a minimum or noexternal DNS queries. Todd Hunter Progressive Systems
Re: [Declude.JunkMail] Setting MAX Testing Weight
My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. No. It is something that we have given thought to, but there are a number of potential problems. As you point out, the order of the tests would now become a factor (which means serious re-working of the code, and slower delivery if DNS lookups are no longer done in parallel). Also, if you are not careful, negative weights could be an issue (for example, if you do not order the tests correctly, you may skip over a test that would reduce the weight to the point where processing should continue). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Setting MAX Testing Weight
You do not want Declude to stop at a certain point. What if it stops, right before the next test which is a whitefilter type test? With the weighting system, it is important to run all tests to get the final weight. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd - Smart Mail Sent: Thursday, August 28, 2003 12:34 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Setting MAX Testing Weight My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. SayI have40 testsand after Declude runsthe first 10 of themit accumulates ascore of 300.IHOLD at 100.Further testing beyond 300uses additional resources to produce the same outcome with no additional benefits. Resources including processing, bandwidth, and un-needed additional queries to blacklist servers that are working hard tomaintain their services. In this scenario the order that Declude ran your tests would be a factor. You could place your tests in a specific order in the Declude configso that primacy tests like Spamcop were first, andadditional tests would onlybe run if needed. Or you couldrun tests like Spamcheck,Badheaders, Helobogus first and be able to HOLD messages with a minimum or noexternal DNS queries. Todd Hunter Progressive Systems
Re: [Declude.JunkMail] Setting MAX Testing Weight
John, As I mentioned, the order that you ran the tests would affect the outcome. Tests that generate a negative weight would need to be run first, such as IPNOTINMX, BONDEDSENDER, and other whitelist type of tests. Also the reason I suggested stopping testing at weigh 3x my HOLD weight. This gives some margin where test would continue to run. Todd - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Thursday, August 28, 2003 9:36 AM Subject: RE: [Declude.JunkMail] Setting MAX Testing Weight You do not want Declude to stop at a certain point. What if it stops, right before the next test which is a whitefilter type test? With the weighting system, it is important to run all tests to get the final weight. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd - Smart MailSent: Thursday, August 28, 2003 12:34 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Setting MAX Testing Weight My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. SayI have40 testsand after Declude runsthe first 10 of themit accumulates ascore of 300.IHOLD at 100.Further testing beyond 300uses additional resources to produce the same outcome with no additional benefits. Resources including processing, bandwidth, and un-needed additional queries to blacklist servers that are working hard tomaintain their services. In this scenario the order that Declude ran your tests would be a factor. You could place your tests in a specific order in the Declude configso that primacy tests like Spamcop were first, andadditional tests would onlybe run if needed. Or you couldrun tests like Spamcheck,Badheaders, Helobogus first and be able to HOLD messages with a minimum or noexternal DNS queries. Todd Hunter Progressive Systems
