On Tue, 25 Jul 2006 14:43:28 Abramov wrote:
>
> Everything mail is under "nice", I limited qmail to 10 concurent
> incoming (plus it is checking 3 RBLs), I have a long list of badmailto
> and badmailfrom, I added a lot of domains to the SA's whitelist, and
> still I have spamassassin choking up. I removed many of the rules from
> SARE and even some of the base. the problems continue, for the sheer
> load on SA. my mail log rotated at 5am and since then (9 hours) SA has
> rejected 5800 spams. this is NUTS. it means barely 5% are legitimates
> and false negatives (I still have those).
My statistics is 690 out of 2277 real mail - 30% spam.
> I managed to get the checking
> time of each mail item from 15-25 to 6-12 seconds, but it's still quite
> long. the problem is that legitimate mail can't compete with the zealous
> spammer cannons, and either gets in late or worse - 5-6 times since the
> remote relay gives up on getting the "250 OK" from the SMTP since the
> test time is still long (I reject mail at the SMTP with simscan).
I did time statics on my spamassassin checking:
time in seconds no. of mails precent
0 - 1.0 962 27.4%
1.1 - 2.0 1530 43.5%
2.1 - 5.0 915 26.0%
5.1 - 10.0 84 2.4%
> 10.0 (max=60) 26 0.7%
so it is much less time than yours.
I suggest you accept the mails and then SILENTLY drop the spam. That
way, you actually lower the bandwidth and accepts all good mails.
I found that when I rejected the spam, most of it returned to me
with some kind of "Returned mail". I think that behavior caused the
huge spam amount you detected.
Ehud.
--
Ehud Karni Tel: +972-3-7966-561 /"\
Mivtach - Simon Fax: +972-3-7966-667 \ / ASCII Ribbon Campaign
Insurance agencies (USA) voice mail and X Against HTML Mail
http://www.mvs.co.il FAX: 1-815-5509341 / \
GnuPG: 98EA398D <http://www.keyserver.net/> Better Safe Than Sorry
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
