Thanks Gary, ----- Original Message ----- From: "Gary V" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Tuesday, September 20, 2005 7:11 PM Subject: Re: [AMaViS-user] Incredible!!
> Rocco wrote: > > > Hello, > > > When I can say that the CPU is on high load looking at the toc command > > output? > > If you look at the sample you provided: > top - 12:14:01 up 1 min, 2 users, load average: 5.32, 1.62, 0.56 > Tasks: 214 total, 9 running, 205 sleeping, 0 stopped, 0 zombie > Cpu(s): 99.3% us, 0.7% sy, 0.0% ni, 0.0% id, 0.0% wa, 0.0% hi, 0.1% si > Mem: 4053708k total, 1352512k used, 2701196k free, 10724k buffers > Swap: 1052648k total, > > This is high load. CPU is 99%, load average for the last minute was > 5.32, this is very high. It is more common to see load averages around > 1, 2 or 3 (or even less), 3 would be about as high as you would want > to go, 2 or less would be more comfortable. It could be that > SpamAssassin was doing a Bayes token expire at the moment of this > snapshot, that could also account for the high load, or it could > have been all your SARE rules, I'm not sure which. CPU should be less > than 99% most of the time. I delete all SARE ruleset but the load was very high too... So I deleted the blacklist* ruleset (14MB about) and now the load is 'comfortable'... But now I'm afraid that the filtering is not so effective... My (2) servers are both dual processor, have controller SCSI RAID, RAID disks 15k, RAM 4 GB and more... What kind of server I must to have to filter all my traffic (about 110.000 messages per day)? :((((( BR, rocsca > > > Which one SARE ruleset you suggest me to use? > > I have no real suggestion here, other that to pay attention to what > rule sets you choose. Read the rules sets themselves. > > Here is an example of what you had: > -rw-r--r-- 1 root root 155889 Jul 18 00:01 70_sare_obfu.cf > -rw-r--r-- 1 root root 58118 Jun 11 22:00 70_sare_obfu0.cf > -rw-r--r-- 1 root root 97771 Jul 18 00:01 70_sare_obfu1.cf > -rw-r--r-- 1 root root 3547 Jun 2 02:00 70_sare_obfu2.cf > -rw-r--r-- 1 root root 9163 Jun 2 02:00 70_sare_obfu3.cf > > It looks to me that 70_sare_obfu.cf contains all the obfu rule sets 0 > through 3. If this is the case, you are doubling up on all these rules > sets. I would either only use the safest set, which would be > 70_sare_obfu0.cf, or the complete set, 70_sare_obfu.cf > > > Thanks, > > rocsca > > Gary V > > > > ------------------------------------------------------- > SF.Net email is sponsored by: > Tame your development challenges with Apache's Geronimo App Server. > Download it for free - -and be entered to win a 42" plasma tv or your very > own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php > _______________________________________________ > AMaViS-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/amavis-user > AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 > AMaViS-HowTos:http://www.amavis.org/howto/ ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
