A question for all you ASSP experts (I'm not one yet unfortunately): ASSP 1.3.3.1 is going unresponsive for periods of 1.5 to 4 minutes, every 10 minutes or so. Only noticed this after upgraded from 1.3.1 to 1.3.3 (maybe a coincidence?) ASSP Config file in use since v1.2.6 (couple of months).
When this happens, CPU usage jumps to 100% during the period, it's usually 4% to 8%. During that time, the ASSP GUI will not respond, and local outgoing SMTP fails (through ASSP). During that time, the POP and IMAP DOES respond (on same machine) TOP shows PERL using most of the CPU cycles. Have examined the logs following episodes, haven't noticed anything unusual. Running on Mac PPC-G4, OSX 10.3.9 - also running mail server. Perl v5.8.1 Not running ClamAV. Delaying/Greylisting is ON. Handling about 3,000 email connections per day. Is a problem because outgoing SMTP fails -- users complaining. Any suggestions would be much appreciated. Here's the ASSP config (wow, long) if that helps. > AVBytes:=70000 > AddConfidenceHeader:= > AddCustomHeader:= > AddIntendedForHeader:=1 > AddLevelHeader:=1 > AddRBLHeader:=1 > AddRWLHeader:=1 > AddRegexHeader:= > AddSPFHeader:=1 > AddScoringHeader:=1 > AddSpamHeader:=1 > AddSpamProbHeader:= > AddSpamReasonHeader:=1 > AddURIBLHeader:=1 > AsADaemon:=1 > AsAService:= > AttachmentError:=500 These attachments are not allowed -- Compress > before mailing. > AvClamdBufSize:=512 > AvClamdLocal:= > AvClamdPort:=/tmp/clamd > AvError:=500 Mail appears infected with '$infection' -- disinfect > and resend. > BadAttachL1:=exe|scr|pif|vb[es]|js|jse|ws[fh]|sh[sb]|lnk|bat|cmd| > com|ht[ab] > BadAttachL2:= > BadAttachL3:= > BayesianLog:= > BlockExes:=1 > BlockNPExes:=0 > BlockUuencoded:=1 > BlockWLExes:=0 > BounceSenders:=postmaster|mailer-daemon > CatchAll:= > ChangeRoot:= > ClamAVBytes:=100000 > CleanDelayDBInterval:=3600 > ConnectionLog:=1 > CustomizeStars:=5 > DEBUG:= > DNSBLServiceProvider:=zen.spamhaus.org|block.rhs.mailpolice.com > DebugSPF:= > DelayAddHeader:=1 > DelayEmbargoTime:=4 > DelayError:=451 4.7.1 Please try again later > DelayExpireOnSpam:=1 > DelayExpiryTime:=36 > DelayLog:=1 > DelayNormalizeVERPs:=1 > DelaySL:= > DelayUseNetblocks:=1 > DelayWL:= > DelayWaitTime:=28 > DoBayesian:=1 > DoBlockExes:=0 > DoBombHeaderRe:=1 > DoBombRe:=1 > DoBombSenderRe:=0 > DoDomainCheck:=1 > DoExtremeNP:= > DoExtremeWL:= > DoFakedLocalHelo:=1 > DoFakedNP:=1 > DoFakedWL:=1 > DoInvalidFormatHelo:=1 > DoInvalidPTR:=0 > DoLDAP:= > DoLocalSender:= > DoNoSpoofing:= > DoNoValidLocalSender:=0 > DoNotCollectBounces:=1 > DoNotCollectRed:=1 > DoNotPenalizeBounces:=1 > DoNotPenalizeRed:= > DoPenalty:=0 > DoPenaltyMessage:= > DoRBLCache:=1 > DoRFC822:=1 > DoReversed:=1 > DoScriptRe:=0 > DoTestRe:= > DoURIBLCache:=1 > DoURIBLCacheMiss:= > DoValidFormatHelo:=1 > EmailAdminReportsTo:[EMAIL PROTECTED] > EmailErrorsModifyWhite:=1 > EmailErrorsReply:=2 > EmailErrorsTo:[EMAIL PROTECTED] > EmailFrom:=<[EMAIL PROTECTED]> > EmailHam:=notspam > EmailHelp:=spamhelp > EmailInterfaceOk:=1 > EmailNoNPRemove:=1 > EmailNoWhiteToRed:= > EmailRedlistAdd:=redlist > EmailRedlistRemove:=notred > EmailRedlistReply:=2 > EmailRedlistTo:[EMAIL PROTECTED] > EmailSenderOK:=file:files/ExtRepOK.txt > EmailSpam:=spam > EmailVirusReportsHeader:= > EmailVirusReportsTo:= > EmailVirusReportsToRCPT:= > EmailWhitelistAdd:=whitelist > EmailWhitelistRemove:=notwhite > EmailWhitelistReply:=2 > EmailWhitelistTo:[EMAIL PROTECTED] > EnableDelaying:=1 > EnableFloatingMenu:=1 > EnableHTTPCompression:=1 > EnableInternalNamesInDesc:=1 > EnableSRS:= > EnforceAuth:= > ErrorMaxBytes:=40000 > ExtremeExpiration:=7 > FilesDistribution:=0.5 > ForceRBLCache:=1 > GoodAttach:=doc|xls|ppt|pdf|zip|sit|stx|rtf|txt|jpg|gif|png|mp3 > GreetingWaitTime:=0 > HeaderMaxBytes:=100000 > HeaderMaxLength:=100000 > HeaderMaxLocal:=1 > HeloMismatch:= > InternalAddresses:= > KeepWhitelistedSpam:= > LDAPFail:= > LDAPFilter:= > LDAPHost:= > LDAPLog:= > LDAPLogin:= > LDAPPassword:= > LDAPRoot:= > LocalAddressesValid:= > LocalAddresses_Flat:= > LocalPolicySPF:=v=spf1 a/24 mx/24 ptr ~all > LogRollDays:=7 > MaillogTailBytes:=12000 > MaillogTailJump:=1 > MaillogTailWrapColumn:=72 > MaintenanceLog:=1 > MaxBytes:=4000 > MaxErrors:=10 > MaxFiles:=18009 > MaxWhitelistDays:=180 > MessageLog:= > NoAutoWhite:= > NoExternalSpamProb:= > NoHaiku:= > NoMaillog:= > NoRelaying:=530 Relaying not allowed > NoScanRe:= > NoTagInTestmode:= > NoValidRecipient:=550 5.1.1 User unknown > NoValidRecipientAnswerDelay:=5 > NonSpamLog:=2 > NotGreedyWhitelist:= > OrderedTieHashSize:=7500 > OutgoingBufSize:=102400 > PenaltyDuration:=60 > PenaltyError:= > PenaltyExpiration:=360 > PenaltyExtreme:=150 > PenaltyLimit:=50 > PenaltyLog:=1 > PenaltyMessageLimit:=50 > PenaltyMessageLow:=40 > PenaltyUseNetblocks:= > PopB4SMTPFile:= > PopB4SMTPMerak:= > RBLCacheRefresh:=24 > RBLError:=550 5.7.1 Blacklisted by RBLLISTED > RBLFailLog:=3 > RBLLog:=1 > RBLServiceProvider:=zen.spamhaus.org|block.rhs.mailpolice.com > RBLUseNetblocks:= > RBLWL:= > RBLmaxhits:=1 > RBLmaxreplies:=2 > RBLmaxtime:=10 > RBLsocktime:=1 > RWLLog:= > RWLServiceProvider:=query.bondedsender.org|exemptions.ahbl.org| > iadb.isipp.com|hul.habeas.com > RWLmaxreplies:=3 > RWLmaxtime:=10 > RWLminhits:=1 > RamSaver:= > RegExLength:=20 > RestartEvery:=0 > SPFError:=554 5.7.1 failed SPF: SPFRESULT > SPFFailLog:=3 > SPFLog:= > SPFNP:= > SPFWL:= > SPFneutral:= > SPFperm:= > SPFsoftfail:= > SPFtemp:= > SPFtrusted:= > SRSAliasDomain:=thisdomain.com > SRSFailLog:=3 > SRSHashLength:=4 > SRSSecretKey:= > SRSTimestampMaxAge:=21 > SRSValidateBounce:= > SaveStatsEvery:=5 > ScanLocal:= > ScanLog:= > ScanNP:= > ScanWL:=1 > SenderInvalidError:=554 5.7.7 REASON . > SepChar:= > SessionLog:= > Showmaxreplies:= > SpamError:=500 Mail appears to be unsolicited -- send error reports > to [EMAIL PROTECTED] > SpamGTUBE:=XJS\*C4JDBQADN1.NSBN3\*2IDNEN\*GTUBE-STANDARD-ANTI-UBE- > TEST-EMAIL\*C.34X > SpamVirusLog:=6 > SuspiciousAttach:= > SuspiciousVirus:= > SysLogFac:=mail > TLDS:=file:files/tlds.txt > URIBLCCTLDS:=file:files/uriblcctlds.txt > URIBLCacheRefresh:=240 > URIBLError:=554 5.7.1 Blacklisted by URIBLNAME Contact the > postmaster of this domain for resolution. This attempt has been > logged. > URIBLFailLog:=3 > URIBLLocal:= > URIBLLog:=1 > URIBLNP:= > URIBLNoObfuscated:= > URIBLPolicyError:=554 5.7.1 Message rejected by domain policy. > Contact the postmaster of this domain for resolution. This attempt > has been logged. > URIBLServiceProvider:=multi.surbl.org > URIBLWL:= > URIBLmaxdomains:=35 > URIBLmaxhits:=1 > URIBLmaxreplies:=1 > URIBLmaxtime:=10 > URIBLmaxuris:=50 > URIBLsocktime:=1 > URIBLwhitelist:=doubleclick.net > UpdateWhitelist:=3600 > UseAvClamd:= > UseLocalTime:=1 > UseSubjectsAsMaillogNames:= > Utf8ToLatin:= > UuencodedError:=554 5.7.1 This mail is uuencoded and will be blocked. > ValidateLog:= > ValidateMaxURI:=1 > ValidateRBL:=1 > ValidateRWL:= > ValidateSPF:=1 > ValidateSenderLog:=1 > ValidateURIBL:=1 > ValidateUserLog:=1 > WhiteExpiration:=30 > WhitelistAuth:= > WhitelistLocalFromOnly:=1 > WhitelistLocalOnly:= > WhitelistOnly:= > acceptAllMail:=216.160.187.242 > allowAdminConnectionsFrom:= > asspLog:=1 > attachSpamLovers:= > attachTestMode:= > baValencePB:=0 > base:=/usr/local/assp > baysConfidence:= > baysConfidenceHalfScore:=1 > baysNonSpamLog:=4 > baysSpamLog:=3 > baysSpamLovers:= > baysSpamLoversRed:= > baysTestMode:=1 > baysValencePB:=0 > blDomainLog:=3 > blSpamLovers:= > blTestMode:= > blValencePB:=5 > blackListedDomains:= > blackRe:=http://[\w\.]+@|\w<[a-z0-9]+[abcdfghjklmnpqrstuvwxyz0-9]{4} > [a-z0-9]*>|subject: [^\n]* \S > blackValencePB:=5 > bombCharSets:=BIG5|CHINESEBIG|GB2312|KS_C_5601|KOI8-R|EUC-KR| > ISO-2022-JP|ISO-2022-KR|ISO-2022-CN|WINDOWS-1251|WINDOWS-1250|CP1251 > bombDataRe:=file:files/bombre.txt > bombError:=550 Your message was rejected because it appears to be > part of a spam bomb -- . > bombErrorReason:=1 > bombHeaderRe:= > bombRe:=IMG [^>]*src=['"]cid|<BODY[^>]*>(<[^>]+>|\n|\r)*<IMG[^>]+>(< > [^>]+>|\n|\r)*</BODY> > bombReLocal:= > bombReNP:= > bombReRelay:= > bombReWL:= > bombSenderRe:[EMAIL PROTECTED] > bombSpamLovers:= > bombSubjectRe:= > bombSuspiciousRe:= > bombSuspiciousValencePB:=20 > bombTestMode:= > bombTestValencePB:=0 > bombValencePB:=5 > ccAddresses:= > ccAddressesMode:= > ccArchivAddressesRec:= > ccArchivModeRec:=1 > ccHamFilter:= > ccMaxBytes:= > ccSpamAlways:= > ccSpamFilter:= > contentOnlyRe:= > correctednotspam:=errors/notspam > correctedspam:=errors/spam > defaultLocalHost:= > delaySpamLovers:= > delaydb:=delaydb > denySMTPConnectionsFrom:=file:files/denysmtp.txt > denySMTPConnectionsFromAlways:= > denySMTPnoLog:= > denySenderRe:= > denyUseNetblocks:=1 > dnsbl:= > erValencePB:=5 > exportExtremeFile:= > exportExtremeFileAppend:= > exportExtremeFileDeny:= > exportExtremeFileMax:=10000 > extAttachLog:=6 > fhTestMode:= > fhValencePB:=200 > fileLogging:=1 > flValencePB:=10 > flsTestMode:= > forgedHeloLog:=6 > freqNonSpam:=1 > freqSpam:=2 > greylist:=greylist > griplist:=griplist > heloBlacklistIgnore:=lists.lorian.net|FVS318v3| > xtinmta06-42.exacttarget.com > hlSpamLovers:= > hlTestMode:= > hlValencePB:=5 > iaValencePB:=25 > idValencePB:=150 > ifValencePB:=150 > ihTestMode:= > ihValencePB:=15 > ilValencePB:=10 > incomingOkMail:= > invalidFormatHeloRe:=\d+[_.-]\d+[_.-]|^[^.]+\.?$|dynamic|ddns|dns > \.org$ > invalidPTRRe:=^\d+\.\d+\.\d+\.\d+$|^[^\.]+\.?$ > irValencePB:=5 > isSpamLovers:= > ispgreyvalue:=0.5 > ispip:=216.160.187.243 > ldLDAP:= > ldLDAPFilter:= > listenPort:=25 > listenPort2:=2500 > localDomains:=file:locdom.txt > localDomainsFile:= > logfile:=logs/assplog.txt > maillogExt:=.eml > malformedLog:=6 > maxSMTPSessions:=32 > maxSMTPdomainIP:=3 > maxSMTPdomainIPExpiration:=7200 > maxSMTPdomainIPWL:=yahoo.com|hotmail.com|gmail.com > maxSMTPdomainsIP:=0 > maxSMTPdomainsIPExpiration:=1800 > maxSMTPipConnects:=5 > maxSMTPipDuration:=90 > maxSMTPipExpiration:=3600 > maxSMTPipSessions:=5 > meValencePB:=15 > msTestMode:= > mxValencePB:=10 > mxaSpamLovers:= > mxaTestMode:=1 > myName:=assp.lorian.net > myServerRe:=216\.160\.187\.241|serve1\.lorian\.net|smtp\.lorian\.net > mydb:= > myhost:= > mypassword:= > myuser:= > noBayesian:= > noBombScript:= > noDelay:=file:files/nodelay.txt > noGriplistDownload:= > noGriplistUpload:= > noLog:= > noPB:= > noProcessing:= > noProcessingDomains:=file:files/noprocdoms.txt > noProcessingIPs:= > noRBL:= > noRWL:= > noSPFRe:= > noSRS:= > noURIBL:= > nolocalDomains:= > notspamlog:=notspam > npAttachLog:=6 > npRe:= > npSize:=500000 > pbSpamLovers:= > pbTestMode:=1 > pbdb:=pb/pbdb > pidfile:=pid > poTestMode:= > processOnlyAddresses:= > proxyserver:= > ptValencePB:=10 > ptrSpamLovers:= > ptrTestMode:= > rblSpamLovers:= > rblTestMode:= > rblValencePB:=100 > rblnValencePB:=25 > redRe:=file:files/redre.txt > redlistdb:=redlist > regexLogging:=1 > relayHost:= > relayHostFile:= > relayPort:= > relayPortNP:= > rlValencePB:=15 > runAsGroup:=admin > runAsUser:= > saValencePB:=25 > satValencePB:=10 > sbTestMode:= > scriptError:=550 Your email contains html scripting code -- please > resend as plain text. > scriptLog:=3 > scriptRe:= > scriptTestMode:=1 > scriptValencePB:=0 > sendAllAbuse:[EMAIL PROTECTED] > sendAllAbuseNP:=1 > sendAllCollect:= > sendAllDestination:= > sendAllPostmaster:[EMAIL PROTECTED] > sendAllPostmasterNP:= > sendAllSpam:= > sendAllTraps:= > sendHamInbound:= > sendHamOutbound:= > sendHamRec:= > sendNoopInfo:= > silent:= > slRe:= > slScoringMode:=1 > smtpAuthServer:= > smtpDestination:=(removed from email, same IP: different port) > smtpDestinationRT:= > smtpIdleTimeout:=300 > smtpReportServer:= > spamBombLog:=6 > spamBucketLog:=1 > spamHeloLog:=6 > spamISLog:=6 > spamLovers:= > spamMSLog:=3 > spamMXALog:=3 > spamPBLog:=6 > spamPTRLog:=3 > spamSubject:=[SPAM] > spamSubjectCC:=1 > spamSubjectSL:= > spamTag:= > spamTagCC:= > spamaddresses:= > spamdb:=spamdb > spamlog:=spam > spamtrapaddresses:= > spfSpamLovers:= > spfTestMode:=1 > spfValencePB:=0 > spfnValencePB:=0 > spfsValencePB:=0 > srsSpamLovers:= > srsTestMode:= > stValencePB:=25 > strictSPFRe:= > subjectLogging:=1 > sysLog:= > sysLogIp:=127.0.0.1 > sysLogPort:=514 > tagLogging:=1 > testRe:= > testScoringMode:=1 > totalizeSpamStats:=1 > uniqeIDLogging:=1 > uniqueIDPrefix:=id- > uriblSpamLovers:= > uriblTestMode:= > uriblValencePB:=20 > uriblnValencePB:=10 > urimaxValencePB:=10 > uriobfValencePB:=10 > useHeloBlacklist:=1 > validFormatHeloRe:=^(([a-z\d][a-z\d\-]*)?[a-z\d]\.)+[a-z]{2,6}$ > vdValencePB:=15 > viruslog:= > vsValencePB:=25 > webAdminPassword:=(removed from email) > webAdminPort:=55555 > whiteListedDomains:=file:files/whitedom.txt > whiteListedIPs:=file:files/whiteIP.txt > whiteRe:= > whitelistdb:=whitelist > wlAttachLog:=5 ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
