Re: [Declude.Virus] PRESCAN

[Matt]

Two replies in one... Nick, it would have helped if I spelled Paessler correctly :)  (http://www.paessler.com/ipcheck)  The Professional License ($349) is required in order to do SNMP monitoring, but the features go far beyond that.  I purchased it because it can alert me based on events, and it can be configured to pre-qualify the events.  I figured that this was a better use of my money over my time, but for those that have a knack, MRTG can do this type of thing and it is freeware.  Paessler also sells this as a service for those that only want a few monitors (http://www.ipcheck-server-monitor.com).  There is a fully functional 30 day trial of the downloadable software. Bill, this is a dual 3.06GHz Xeon system that was built for speed.  >From my previous tests, the only virus scanners that are faster than McAfee are F-Prot and ClamAV in daemon mode, but I can't remember if I tested Trend Micro (search the archives for "scanner efficiency olympics").  Keep in mind that a jump from 15% to 21% is a 40% increase, and so is a jump from 60% to 84%.  My hourly averages have now had a bit more time to build, and it actually looks more like a 50% increase in utilization. I have yet to configure my gateways to do full address validation, and at least 25% of my traffic is coming from dictionary attacks and going to dead addresses.  My utilization decreases dramatically when I tested validation for the majority of my customer base, but I need to get the thing automated before I leave it that way.  All of this traffic is not being virus scanned with PRESCAN ON, but I believe that you are doing address validation and that would lessen the impact on your system.  Some of the other things that you do with your gateway might also be taking out a good deal of other things (zombie spam) that similarly lack things that would trip PRESCAN.  So it is likely that more of the E-mail reaching your Declude Virus installation was being scanned prior to turning PRESCAN off than on mine. Matt Nick wrote: On 10 Nov 2004 at 16:33, Matt wrote: Matt - Would you elaborate on the Passler app? Where from how much? -Nick Bill Landry wrote: Matt, thanks for the analysis. I would very much like to know what the additional load is on your server by setting PRESCAN to OFF. Please do post your results if you test this. I have had PRESCAN OFF for a few weeks now, and have not noticed much of an increase on my servers, but I was not near capacity anyway. Bill, I've got a handy app from Passler that provides me with nice graphs including processor utilization that I am sampling every minute (minute averages). I just turned PRESCAN OFF a short while ago and it's actually a bit worse than a 25% relative increase on my system. My hourly average went directly from 33% to 46% with PRESCAN OFF, which is a 39% increase. I've attached an image of the minute averages with a green line marking the point when I turned PRESCAN OFF. Take note that I run both F-Prot and McAfee on my system, so systems with only one virus scanner won't see the same degree of a jump, though it should be rather large. On systems with plenty of capacity, this is not a concern and the increase would be not very noticeable despite being relatively high, but I would like to fill this box to capacity and add more, but not before I have to. Matt -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================