Is the below line correct (assuming REVERSEDNSFILTER is one of my filters that occurs before the filter I put the below line in)?
TESTSFAILED END CONTAINS REVERSEDNSFILTER
[2] When that line is matched does it show in the logs?
Darrell
-----------------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude and Imail.
Scott Fisher writes:
I haven't found any easy way to tell. The information is in the logs at high level.
But I can chime in that SKIPIFWEIGHT bypasses about 80% of my e-mail that is obviously spam. TESTSFAILED ENDS for "friendly domains/revdns" drop off about 8% of e-mail that is most likely not spam, leaving about 12% of the e-mail that I run body filters on.
Scott Fisher
Director of IT
Farm Progress Companies
Matt-[EMAIL PROTECTED] 06/17/04 12:03PM >>>
My body filters only catch about 4% of messages, but I don't know how often
they are run. Is htere a convenient way to tell?
-d
----- Original Message ----- From: "Matt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 17, 2004 12:40 PM
Subject: Re: [Declude.JunkMail] Declude and attachments
Scott,As
I've got a lot more BODY filters than Dave has, though I don't feel that
they are excessive. I probably have about 1,500 BODY searches, but with
SKIPIFWEIGHT they only run about 25% of the time.
If Dave is using Declude Virus, I would also look there for the issue.
Anything besides F-Prot and ClamAV in daemon mode will chug a server on
a large attachment and it will use up far more processing than Declude
JunkMail, but it will keep the Declude instance alive for longer. On
about 65,000 messages a day currently, we generally see from 2 to 10
Declude processes running at one time with both F-Prot and AVG enabled
(much less with just F-Prot). Disabling AVG results in our average
processor utilization dropping by 1/3 to 1/2 on heavy load hours.
Matt
R. Scott Perry wrote:
> >> One instance of Declude, then two, then three, all in the 25%+ range.>> soon as it dropped to two Decludes, Queue Manager came right in at(http://www.declude.com)]
>> 30-40%,
>> then the cycles dropped as QueueManager dropped down.
>
>
> It does sound like it is the large files that are causing the problem.
>
> One option would be to temporarily disable the BODY filter with the
> 200 lines in it, to see if that prevents the problem with the high CPU
> usage in Declude JunkMail. That could indeed be causing the problem.
>
> The other would be to use the debug mode ("LOGLEVEL DEBUG" in the
> \IMail\Declude\global.cfg file) and waiting for one of these files to
> be sent. We can look at the debug log file entries to get a better
> idea of where the high CPU usage is occurring.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail
> mailservers since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in
> mailserver vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)] >
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
>
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
