RE: [Declude.JunkMail] Mail Backlogging

Wed, 31 May 2006 05:57:02 -0700

Matt,

 

Thank you for the suggestions, I will try these settings and keep an eye on it.  I had turned winsockcleanup on due to an issue where I was no longer able to perform dns queries until the decludeproc was restarted.  I’ve turned it off again per your suggestion, which I hope is now fixed.

 

I’m still trying to understand the country filter however.  I see two methods for this, one is the sample filter already in the global.cfg, which uses the filter-country.txt to add weight based what appears to be domain extension.  The other is a command called COUNTRY, which uses the all_list.dat file.  The filter-country.txt file doesn’t seem like it will be accurate enough.  Does anyone have an example of how to use the COUNTRY filter to delete mail from specific countries or at least add an action to like warn?

 

I have only been able to find the following example, but the syntax doesn’t make sense as all the other filters have weights.

 

COUNTRY END IS US

COUNTRY END IS CA

REMOTEIP 5 CONTAINS .

 

If I were to add these three lines to my global.cfg, I’m not sure what that would do.

 

Will

 

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Tuesday, May 30, 2006 7:05 PM
To: [email protected]
Subject: Re: [Declude.JunkMail] Mail Backlogging

 

Will,

You should change the following settings:

WAITFORMAIL   1000
WAITFORTHREADS   100
WINSOCKCLEANUP    OFF

If you have two virus scanners configured and external tests like Sniffer, Eradispam, invURIBL, etc. configured, I would recommend dropping the threads down to 40.  If you have less than a total of 5 Ghz of physical processors, I would drop that number (either 75 or 40) by another 1/3.  This isn't that important though, it's just about not pounding on your server too hard, especially when you are recovering from a big backup of E-mail.

The WAITFORTHREDS setting is the most important.  Essentially it waits 1.5 seconds between each E-mail with your default settings.  A server can only process 57,600 messages a day with that much wait.  Declude should change this default setting to something much lower.  You would need no more than 500 ms in order to keep up with your 140,000 volume (if that is what Declude processes), and you would likely be backing up during the busier hours.  Setting it to 100 ms allows your system to max out at 10 messages per second if it were able to handle that load.

WINSOCKCLEANUP likely lowers your ability to process E-mail even further.  Unless you had issues and were told to turn this on, you definitely should turn it off on a busy server, otherwise you will be delaying E-mail processing further.  Even if you had this on before, you might want to test it with a more recent Declude release and it turned off just to see if it is stable again.  My read on this is that it was introduced to clean up a leak of some sort that is no longer happening because either the code is fixed, or the trigger is no longer occurring in the wild.

Opinions may vary, but you have mine now, and based on my experience so far, I would say that this should do it.

Matt






Will wrote:

Here is my declude.cfg file:

 

#THREADS                   15

THREADS                     75

 

#WAITFORMAIL Defined in milliseconds eg. 5000 = 5 seconds this can be changed to set the

#wait time that decludeproc will wait before checking the \proc directory once empty for new messages.

 

WAITFORMAIL              5000

 

#INVITEFIX   Some customers had issues related to Outlook meeting requests appearing as text only.

 

INVITEFIX          ON

 

 

#ADVANCED CONFIGURATIONS

#------------------------------------------------

 

#WAITFORTHREADS Defined in milliseconds eg. 1500 = 1.5 seconds this can be changed so that when the maximum 

#threads are in use this time specifics the wait before checking to launch more threads.

 

#WAITFORTHREADS                1500

 

#WAITBETWEENTHREADS  Defined in milliseconds eg. 1 = 1 millisecond The time to wait between spawning one

# thread and  starting to process another thread.

 

#WAITBETWEENTHREADS   1

 

#WINSOCKCLEANUP some customers had issues related to their network stack causing loss of functionality for basic

#network operations.The default for this directive is OFF

 

WINSOCKCLEANUP       ON

 

#AUTOREVIEW Email in the \review directory is automatically moved to the \proc directory when the service starts

# or when the proc directory is empty

 

#AUTOREVIEW             OFF

 

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Tuesday, May 30, 2006 3:39 PM
To: [email protected]
Subject: Re: [Declude.JunkMail] Mail Backlogging

 

Will,

You want to attach your Declude.cfg and not your Global.cfg.  If you haven't tweaked those settings, you will likely have issues at 140,000 per day.  If  you post it I'm sure that there will be some recommendations that will take care of your issues.

Matt



Will wrote: 

I am using hijack with its default settings.  My Declude seems to
function just fine as I'm watching but every other or third weekend it
seems like I come in on a Monday to see a couple hundred thousand
messages in the proc folder.  I only allow 50 recipients per message,
have no loops, no catchall aliases.  Looks like I typically receive
around 140,000 per day so it is pretty strange to come in after two days
and see 500,000 messages.  However, it was a holiday weekend...
 
A report for one of my normal days can be seen here:
http://mail.ncats.net/report.html
 
My global.cfg is attached
 
I'm a little confused about the syntax of the country command.  Is there
any official documentation or examples available?  I have been searching
for them with little luck.
 
It would be nice to have a declude log analyzer that would display a
list of IP's organized by spam counts so I could start blacklisting some
subnets, If that would be at all helpful to me.
 
Will
 
 
 
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Craig Edmonds
Sent: Tuesday, May 30, 2006 11:33 AM
To: [email protected]
Subject: RE: [Declude.JunkMail] Mail Backlogging
Importance: High
 
 
I would also recommend the declude hijack filter.
 
It has saved me a couple of times.
 
Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.com
E : [EMAIL PROTECTED]
 
Marbella Guide Web Portal
W: www.marbellaguide.com
E: [EMAIL PROTECTED]
 
 
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Tuesday, May 30, 2006 5:10 PM
To: [email protected]
Subject: Re: [Declude.JunkMail] Mail Backlogging
 
Will,
 
Do you have any catch-all (nobody) aliases for any of your domains?  If
so,
a single such domain can overwhelm a server when under dictionary
attack.
Catch-alls must be removed.  The traffic will disappear immediately if
this
is the case.
 
Also, it is definitely not uncommon for a business like yours to have
clients using your server for bulk-mailing.  You should set reasonable
recipient limits per message (like 50 or so) and watch for people that
have
automated software that sends out even more.
 
Looping can cause issues like this as well.
 
Lastly, you may need to tweak your Declude.cfg settings in order to
handle
the normal traffic that you see.  It seems that a lot of the higher
volume
servers backup when using the default settings, so this effect may be
different from what you were seeing in the past.  Maybe you could share
your
normal and peak volume along with your Declude.cfg settings with the
list
and get some feedback.
 
Matt
 
 
 
Will wrote:
 
  


I have had a problem with my Imail server backlogging mail for years
    



now
  



where the spool directory will fill with hundreds of thousands of
messages.  Now it's the proc folder with the new version of declude.
This issue has been ongoing throughout the years as I have upgraded
    



both
  



Imail and Declude.  It has come to the point where I have to purge
500,000 messages to get my mail server running again.
 
I'm not sure what to do, as I need the virus and spam protection.
 
Is there a way to block all mail from Romania and china?
 
Will
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 
 
 
 
    



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
[ This E-mail has been scanned for Spam and Viruses by Declude ]
[ Thank You For Using 123 Marbella Internet ]
 
 
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 

Reply via email to