Re: [Declude.JunkMail] Mail Backlogging

[Matt]

Will, You should change the following settings: WAITFORMAIL   1000 WAITFORTHREADS   100 WINSOCKCLEANUP    OFF If you have two virus scanners configured and external tests like Sniffer, Eradispam, invURIBL, etc. configured, I would recommend dropping the threads down to 40.  If you have less than a total of 5 Ghz of physical processors, I would drop that number (either 75 or 40) by another 1/3.  This isn't that important though, it's just about not pounding on your server too hard, especially when you are recovering from a big backup of E-mail. The WAITFORTHREDS setting is the most important.  Essentially it waits 1.5 seconds between each E-mail with your default settings.  A server can only process 57,600 messages a day with that much wait.  Declude should change this default setting to something much lower.  You would need no more than 500 ms in order to keep up with your 140,000 volume (if that is what Declude processes), and you would likely be backing up during the busier hours.  Setting it to 100 ms allows your system to max out at 10 messages per second if it were able to handle that load. WINSOCKCLEANUP likely lowers your ability to process E-mail even further.  Unless you had issues and were told to turn this on, you definitely should turn it off on a busy server, otherwise you will be delaying E-mail processing further.  Even if you had this on before, you might want to test it with a more recent Declude release and it turned off just to see if it is stable again.  My read on this is that it was introduced to clean up a leak of some sort that is no longer happening because either the code is fixed, or the trigger is no longer occurring in the wild. Opinions may vary, but you have mine now, and based on my experience so far, I would say that this should do it. Matt Will wrote: Here is my declude.cfg file:   #THREADS                   15 THREADS                     75   #WAITFORMAIL Defined in milliseconds eg. 5000 = 5 seconds this can be changed to set the #wait time that decludeproc will wait before checking the \proc directory once empty for new messages.   WAITFORMAIL              5000   #INVITEFIX   Some customers had issues related to Outlook meeting requests appearing as text only.   INVITEFIX          ON     #ADVANCED CONFIGURATIONS #------------------------------------------------   #WAITFORTHREADS Defined in milliseconds eg. 1500 = 1.5 seconds this can be changed so that when the maximum  #threads are in use this time specifics the wait before checking to launch more threads.   #WAITFORTHREADS                1500   #WAITBETWEENTHREADS  Defined in milliseconds eg. 1 = 1 millisecond The time to wait between spawning one # thread and  starting to process another thread.   #WAITBETWEENTHREADS   1   #WINSOCKCLEANUP some customers had issues related to their network stack causing loss of functionality for basic #network operations.The default for this directive is OFF   WINSOCKCLEANUP       ON   #AUTOREVIEW Email in the \review directory is automatically moved to the \proc directory when the service starts # or when the proc directory is empty   #AUTOREVIEW             OFF     -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Tuesday, May 30, 2006 3:39 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Mail Backlogging   Will, You want to attach your Declude.cfg and not your Global.cfg.  If you haven't tweaked those settings, you will likely have issues at 140,000 per day.  If  you post it I'm sure that there will be some recommendations that will take care of your issues. Matt Will wrote: I am using hijack with its default settings.  My Declude seems to function just fine as I'm watching but every other or third weekend it seems like I come in on a Monday to see a couple hundred thousand messages in the proc folder.  I only allow 50 recipients per message, have no loops, no catchall aliases.  Looks like I typically receive around 140,000 per day so it is pretty strange to come in after two days and see 500,000 messages.  However, it was a holiday weekend...   A report for one of my normal days can be seen here: http://mail.ncats.net/report.html   My global.cfg is attached   I'm a little confused about the syntax of the country command.  Is there any official documentation or examples available?  I have been searching for them with little luck.   It would be nice to have a declude log analyzer that would display a list of IP's organized by spam counts so I could start blacklisting some subnets, If that would be at all helpful to me.   Will     -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Craig Edmonds Sent: Tuesday, May 30, 2006 11:33 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Mail Backlogging Importance: High   I would also recommend the declude hijack filter.   It has saved me a couple of times.   Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : [EMAIL PROTECTED] Marbella Guide Web Portal W: www.marbellaguide.com E: [EMAIL PROTECTED]   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Tuesday, May 30, 2006 5:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Mail Backlogging   Will,   Do you have any catch-all (nobody) aliases for any of your domains?  If so, a single such domain can overwhelm a server when under dictionary attack. Catch-alls must be removed.  The traffic will disappear immediately if this is the case.   Also, it is definitely not uncommon for a business like yours to have clients using your server for bulk-mailing.  You should set reasonable recipient limits per message (like 50 or so) and watch for people that have automated software that sends out even more.   Looping can cause issues like this as well.   Lastly, you may need to tweak your Declude.cfg settings in order to handle the normal traffic that you see.  It seems that a lot of the higher volume servers backup when using the default settings, so this effect may be different from what you were seeing in the past.  Maybe you could share your normal and peak volume along with your Declude.cfg settings with the list and get some feedback.   Matt       Will wrote:     I have had a problem with my Imail server backlogging mail for years     now   where the spool directory will fill with hundreds of thousands of messages.  Now it's the proc folder with the new version of declude. This issue has been ongoing throughout the years as I have upgraded     both   Imail and Declude.  It has come to the point where I have to purge 500,000 messages to get my mail server running again.   I'm not sure what to do, as I need the virus and spam protection.   Is there a way to block all mail from Romania and china?   Will     --- This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail".  The archives can be found at http://www.mail-archive.com.           --- This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail".  The archives can be found at http://www.mail-archive.com. [ This E-mail has been scanned for Spam and Viruses by Declude ] [ Thank You For Using 123 Marbella Internet ]         --- This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail".  The archives can be found at http://www.mail-archive.com.