Matt,
Thank you for the
suggestions, I will try these settings and keep an eye on it. I had
turned winsockcleanup on due to an issue where I was no longer able to perform
dns queries until the decludeproc was restarted. I’ve turned it off
again per your suggestion, which I hope is now fixed.
I’m still trying to
understand the country filter however. I see two methods for this, one
is the sample filter already in the global.cfg, which uses the
filter-country.txt to add weight based what appears to be domain
extension. The other is a command called COUNTRY, which uses the
all_list.dat file. The filter-country.txt file doesn’t seem like it will
be accurate enough. Does anyone have an example of how to use the
COUNTRY filter to delete mail from specific countries or at least add an
action to like warn?
I have only been able
to find the following example, but the syntax doesn’t make sense as all the
other filters have weights.
COUNTRY END IS
US
COUNTRY END IS
CA
REMOTEIP 5 CONTAINS
.
If I were to add
these three lines to my global.cfg, I’m not sure what that would
do.
Will
-----Original
Message-----
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Matt
Sent: Tuesday, May 30, 2006 7:05
PM
To:
[email protected]
Subject: Re: [Declude.JunkMail] Mail
Backlogging
Will,
You should
change the following settings:
WAITFORMAIL
1000
WAITFORTHREADS 100
WINSOCKCLEANUP
OFF
If you have two virus scanners configured and external tests like
Sniffer, Eradispam, invURIBL, etc. configured, I would recommend dropping the
threads down to 40. If you have less than a total of 5 Ghz of physical
processors, I would drop that number (either 75 or 40) by another 1/3.
This isn't that important though, it's just about not pounding on your server
too hard, especially when you are recovering from a big backup of
E-mail.
The WAITFORTHREDS setting is the most important.
Essentially it waits 1.5 seconds between each E-mail with your default
settings. A server can only process 57,600 messages a day with that much
wait. Declude should change this default setting to something much
lower. You would need no more than 500 ms in order to keep up with your
140,000 volume (if that is what Declude processes), and you would likely be
backing up during the busier hours. Setting it to 100 ms allows your
system to max out at 10 messages per second if it were able to handle that
load.
WINSOCKCLEANUP likely lowers your ability to process E-mail even
further. Unless you had issues and were told to turn this on, you
definitely should turn it off on a busy server, otherwise you will be delaying
E-mail processing further. Even if you had this on before, you might
want to test it with a more recent Declude release and it turned off just to
see if it is stable again. My read on this is that it was introduced to
clean up a leak of some sort that is no longer happening because either the
code is fixed, or the trigger is no longer occurring in the
wild.
Opinions may vary, but you have mine now, and based on my
experience so far, I would say that this should do
it.
Matt
Will wrote:
Here is
my declude.cfg file:
#THREADS
15
THREADS
75
#WAITFORMAIL Defined
in milliseconds eg. 5000 = 5 seconds this can be changed to set the
#wait
time that decludeproc will wait before checking the \proc directory once empty
for new messages.
WAITFORMAIL
5000
#INVITEFIX
Some customers had issues related to Outlook meeting requests appearing as
text only.
INVITEFIX
ON
#ADVANCED
CONFIGURATIONS
#------------------------------------------------
#WAITFORTHREADS
Defined in milliseconds eg. 1500 = 1.5 seconds this can be changed so that
when the maximum
#threads
are in use this time specifics the wait before checking to launch more
threads.
#WAITFORTHREADS
1500
#WAITBETWEENTHREADS
Defined in milliseconds eg. 1 = 1 millisecond The time to wait between
spawning one
# thread
and starting to process another thread.
#WAITBETWEENTHREADS
1
#WINSOCKCLEANUP some
customers had issues related to their network stack causing loss of
functionality for basic
#network
operations.The default for this directive is OFF
WINSOCKCLEANUP
ON
#AUTOREVIEW Email in
the \review directory is automatically moved to the \proc directory when the
service starts
# or
when the proc directory is empty
#AUTOREVIEW
OFF
-----Original
Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Matt
Sent: Tuesday, May 30, 2006 3:39
PM
To: [email protected]
Subject: Re: [Declude.JunkMail] Mail
Backlogging
Will,
You want to
attach your Declude.cfg and not your Global.cfg. If you haven't tweaked
those settings, you will likely have issues at 140,000 per day. If
you post it I'm sure that there will be some recommendations that will take
care of your issues.
Matt
Will wrote:
I am using hijack with its default settings. My Declude seems to
function just fine as I'm watching but every other or third weekend it
seems like I come in on a Monday to see a couple hundred thousand
messages in the proc folder. I only allow 50 recipients per message,
have no loops, no catchall aliases. Looks like I typically receive
around 140,000 per day so it is pretty strange to come in after two days
and see 500,000 messages. However, it was a holiday weekend...
A report for one of my normal days can be seen here:
http://mail.ncats.net/report.html
My global.cfg is attached
I'm a little confused about the syntax of the country command. Is there
any official documentation or examples available? I have been searching
for them with little luck.
It would be nice to have a declude log analyzer that would display a
list of IP's organized by spam counts so I could start blacklisting some
subnets, If that would be at all helpful to me.
Will
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Craig Edmonds
Sent: Tuesday, May 30, 2006 11:33 AM
To: [email protected]
Subject: RE: [Declude.JunkMail] Mail Backlogging
Importance: High
I would also recommend the declude hijack filter.
It has saved me a couple of times.
Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.com
E : [EMAIL PROTECTED]
Marbella Guide Web Portal
W: www.marbellaguide.com
E: [EMAIL PROTECTED]
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Tuesday, May 30, 2006 5:10 PM
To: [email protected]
Subject: Re: [Declude.JunkMail] Mail Backlogging
Will,
Do you have any catch-all (nobody) aliases for any of your domains? If
so,
a single such domain can overwhelm a server when under dictionary
attack.
Catch-alls must be removed. The traffic will disappear immediately if
this
is the case.
Also, it is definitely not uncommon for a business like yours to have
clients using your server for bulk-mailing. You should set reasonable
recipient limits per message (like 50 or so) and watch for people that
have
automated software that sends out even more.
Looping can cause issues like this as well.
Lastly, you may need to tweak your Declude.cfg settings in order to
handle
the normal traffic that you see. It seems that a lot of the higher
volume
servers backup when using the default settings, so this effect may be
different from what you were seeing in the past. Maybe you could share
your
normal and peak volume along with your Declude.cfg settings with the
list
and get some feedback.
Matt
Will wrote:
I have had a problem with my Imail server backlogging mail for years
now
where the spool directory will fill with hundreds of thousands of
messages. Now it's the proc folder with the new version of declude.
This issue has been ongoing throughout the years as I have upgraded
both
Imail and Declude. It has come to the point where I have to purge
500,000 messages to get my mail server running again.
I'm not sure what to do, as I need the virus and spam protection.
Is there a way to block all mail from Romania and china?
Will
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
[ This E-mail has been scanned for Spam and Viruses by Declude ]
[ Thank You For Using 123 Marbella Internet ]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
