I'll try implementing these here in the next day or so after read up on the documentation for them. Care to explain what the size.vbs file is?James,
If you are using the latest beta (1.79), you can use the filters in the hidden beta section of my site:
http://www.mailpure.com/software/decludefilters/beta/
These make use of several new enhancements that can cut the processor utilization of these filters by probably 90% (primarily from the SKIPIFWEIGHT setting). They also simplify the convoluted ANTI filters by doing everything within one single file.
You can also gain a benefit from WHITELIST AUTH in your Global.cfg which whitelists all authenticated users (latest Declude beta and IMail 8.x required).
It seems from the stats that you posted that there is excessive incoming traffic, possibly related to a dictionary attack. If you have domains configured for the nobody alias, try as hard as you can to get rid of them. This can result in every dictionary attack message being scanned, and just in case you are wondering, no, spammers don't care if your server accepts every last message or not, they just keep the dictionary attack running, and recently there has been a rise in full-on dictionary attacks using tens of thousands of addresses or more. These can come from a single IP, or they can be distributed. You should be able to tell if something is happening by just looking at the size of your logs.
Matt
We do not have any "nobody" aliases (I can guess the problems that could cause) on any of our domains. However, our major domains are provided to dial-up users and have been around for close to 8 years, so I'm sure many of them are probably on spam lists. I'd guess that the most of the 5-8K outgoing messages from "postmaster" are spam and/or virus related.
::James Nelson --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
