RE: [Declude.JunkMail] Multi Server Configs

[Jim Rooth]

I usually find the manual updates to be quicker than the auto updates.  I have gone into the program right after an update was ran and did a manual update and received a file where the auto did not get it.  One of the few (very few) things I am not happy with F-Prot about.  Something that is easily overshadowed by the good things…with maybe the message.kip thing.  Had to spell it that way or it wouldn’t get through my server (protected by Declude Spam, Virus, Hijack and my Colt .45!   Jim Rooth Clotron, Inc [EMAIL PROTECTED] 214.244.0979   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Thursday, August 21, 2003 2:47 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Multi Server Configs   I saw a large number of banned attachments hit early on Monday, and it wasn't until my 3:15 p.m. virus definition update on the 20th that Declude started tagging the virus.  I believe the Symantec fix was available on the 19th. Maybe I had a problem, but my download logs from ftp.f-prot.com show that the file changed sizes at that time from the previous 24 hours.  Could it be that those files are updated less frequently then their automatic update system? John Tolmachoff (Lists) wrote: Actually, F-Prot was catching Sobig.F almost immediately from reports on the list on Tuesday. McAfee was the lager this time.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matthew Bramble Sent: Thursday, August 21, 2003 10:30 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Multi Server Configs   We have a little less volume than you do, but it's amazing how concentrated the messages can be.  My personal account which has many domains pointed at it has not received a single copy of the virus, but one account on our server has been hit over 500 times in the last 48 hours.  We run Declude Virus, but it's only available to about half of the accounts, JunkMail though has caught everything that gets there. Here's an important suggestion, although this is virus related (I'm not on that list).  I use the FProt engine, which is nice because most clients use McAfee or Norton on the desktop, however this virus was getting blocked by extension exceptions (scr, bat, pif, com and vbs) for over 36 hours before the virus definitions were updated (checked every 6 hours).  This isn't the first time that has happened either.  The antivirus companies are too slow IMO in getting their updates out as this has happened repeatedly in the last year.  I would therefore refuse a customer's request to allow any of these extensions through...but never has a customer refused such a thing, so I even turned notifications off for banned extensions. This does tie back into processor utilization though, because before the definitions were available, the banned extension test was placing those E-mails in a hold (wish you could have them deleted).  The system seems though to scan the attachments first and then look for attachments to ban by extension, and that order could be reversed to save processing power.  I assume this because the virus detection is now catching these files subsequent to the definitions update instead of the banned extension test doing the dirty work.  Any file intensive operations though benefit greatly from a spanned array, and RAID 5 can be a better investment than processing power in my experience, and a simple mirror actually steals a good deal of processing from your server.  We run about 80 Web sites, 50 E-mail domains with virus and spam blocking, a SQL server with many connected sites, and DNS, but dual PIII 1 Ghz processors, a gig of memory and a 5 disk array keeps the average processor utilization at around 2% even during this outbreak, with peaks lower than 50% utilization.  I think I overbuilt the box :) Matt Colbeck, Andrew wrote: Wow, I thought my increase in messages from 5,800 messages inbound to 10,000 was a lot.   BTW, my old mail server (PII @ 333 MHz, data on a SCSI2 mirror) with the same volume would regularly run mid-morning (my peak volume) with a 30 to 100 messages in the overflow folder.   The new server (PIII @ 1.266, data on a SCSI3 mirror) had zero messages in the overflow with exactly the same configuration (well, not true; I also put in a body text filter to hold some of those annoyingly but misguided messages from mailservers that are warning us of a virus we didn't send - caught 1,300 of them by 10pm).   So last night I updated the Declude config to bring up our configuration from 1.65 to 1.75i2 with most of the tests like PREWHITELIST ON, SPAMDOMAINS, COMMENTS, SUBJECTSPACES, LONGSUBJECT, NONENGLISH.   I used as my guide, advice on the list and the page:   http://www.declude.com/relnotes.htm   Andrew 8)   p.s. Of everything that was new and/or discussed since the previous release, SPAMDOMAINS was certainly the toughest nut.   -----Original Message----- From: Webmaster Oilfield Directory [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 21, 2003 10:10 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Multi Server Configs     LOL!  that's peanuts...... try 70,000 ...yes 70,000 per hour and then tell me about being nailed ... and i didn't have a powerhouse like you...only a 400mhz p2   in otherwords 2.5 million in 24 hours.....     Sheldon     ----- Original Message ----- From: "Tom Baker|Netsmith Inc" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, August 21, 2003 6:15 AM Subject: RE: [Declude.JunkMail] Multi Server Configs       Dan, Declude does not have that kind of power as it is the IMAIL SMTP Daemonwhich accepts the mail and places it into the spool.After it is in the spool declude queue moves it to the overflow for fasterprocessing if there are more messages in the spool than imail can runsmtp-delivery processes for (MaxQueProc). See    http://www.declude.com/dq.htm  for more information on how exactly the overflow works. If you want to reject messages before the SMTP envelope is over let mesuggest you take a look at 'IMGate' http://imgate.meiway.com/  IMGate isbasically a set of configurations for a free Unix OS(Linux or FreeBSDwww.freebsd.org) with the (free) Postfix MTA (www.postfix.org). Postfix    does  have the ability for its SMTP Daemon to reject messages during the firstSMTP session based on header and body rules. Many of the people running declude also have one of these servers running    in  front of our Imail/Declude server to reject such floods. During the start    of  the SoBig flood I modified my body checks to reject any message with a    .pif  attachment, and modified my header checks to reject any message containingsubject lines of those that the sobig worm uses.Yesterday I rejected over 10,000 messages based on these rules..Thats 10,000 messages declude never had to process because they wererejected with a "550 code" at the SMTP level. There may be some other suggestions on this list, but I think this issomething worth at least taking a look at. -Tom -----Original Message-----From: Dan Patnode [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 21, 2003 2:30 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Multi Server Configs  I'm running twin dual Xeon 2.4s and was nearly wiped out today by all theextra virus/worm activity.  Its midnight and I'm still clearing out theoverflow, to the tune of 2 dozen Declude processes. Rather than running them in parallel as we had before (setting them up    with  the same MX weight), we are running these in series (every message hits    the  first server until it says uncle, then the second server gets some).Trouble is, the 1st server didn't refuse incoming mail, it just kept    piling  up in overflow - to the tune of about 10,000 message in the course of asingle morning. Is there a way to configure Imail/Declude so as not to use overflow,    instead  refusing additional connections so they are passed to secondary servers? ThanksDan  PS, more on CPU load itself later ---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)] ---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus    (http://www.declude.com)]  ---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.      ---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)] ---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] ---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.    -- =================================================== Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of NYcars.com --------------------------------------------------- Office Phone: (518) 862-9042 Cellular: (518) 229-3375 Fax: (518) 862-9044 E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] =================================================== --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.512 / Virus Database: 309 - Release Date: 8/19/2003 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.512 / Virus Database: 309 - Release Date: 8/19/2003