Rocco wrote: > I delete all SARE ruleset but the load was very high too...
> So I deleted the blacklist* ruleset (14MB about) and now the load is > 'comfortable'... > But now I'm afraid that the filtering is not so effective... > My (2) servers are both dual processor, have controller SCSI RAID, RAID > disks 15k, RAM 4 GB and more... What kind of server I must to have to filter > all my traffic (about 110.000 messages per day)? > :((((( > BR, > rocsca I think what you have is very good, but maybe the particular SARE rules you chose add too much load. SpamAssassin is CPU intensive. The blacklist rules are expensive. The developers of SpamAssassin have spent a great deal of time making SpamAssassin effective (without the help of SARE rules), I'm sure they would be disappointed if it is not. In general, once a server has been tuned for maximum throughput, and it gets to the point it cannot handle any more mail than it does, the next step is typically to add another server to absorb some of the load. Since you have two, I would guess you have already done this. Your two servers should be able to handle 110,000 messages a day. A couple of things that are typically recommended for busy servers are to move Bayes to SQL, and to disable opportunistic bayes_auto_expire, then set up a cron job (as your vscan user) to 'sa-learn --sync --force-expire' Bayes tokens once each day during your slowest period. Just make sure your cron job actually works, or your Bayes files will grow forever. I'm sorry, I can't help you with details on migrating Bayes to SQL, I have not done it myself with SpamAssassin 3.1, but this link still may help you get an idea of what is involved: http://www200.pair.com/mecham/spam/debian-spamassassin-sql.html also read: http://svn.apache.org/repos/asf/spamassassin/branches/3.1/UPGRADE for changes to how SQL may be used. Another concern I have is that you are using old versions of ClamAV. You really do not get protection from newer viruses by using old versions. I would also insure that amavisd-new is using clamd, and not the secondary virus scanner 'clamscan'. If you look in your logs, and you see "WARN: all primary virus scanners failed, considering backups" then amavisd-new is wasting time looking for clamd (and possibly other scanners). If this is a permission problem, you can often fix this by adding the clamav user to the vscan (may be called 'amavis') group. For more details on how to get clamd configured for use with amavisd-new, see: http://www200.pair.com/mecham/spam/clamav-amavisd-new.html Looks like here are your SuSE RPMs: ftp://ftp.suse.com/pub/projects/clamav/ You might also consider installing Razor2, if you have not already done so. With SpamAssassin 3.1, if you were to install Razor2, you would enable it by uncommenting: #loadplugin Mail::SpamAssassin::Plugin::Razor2 in the v310.pre file. Gary V ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
