Re: [Declude.JunkMail] Declude Processes Server Load
Hi Scott, I see the same (with a very small domain and very light usage). The mail server is nowhere near the strongest, but is sometmies stressed with 1.70 (and was the same with 1.69b) but not 1.65. My recommendation for those that are experiencing this is to try adding a line DECODE OFF to the \IMail\Declude\global.cfg file, and see if this takes care of the problem. There were some base64 and HTML decoding functions added since 1.65, which use more CPU time than most Declude JunkMail functionality. They can be disabled with the DECODE OFF line. Well as you can read in another mail I went back to 1.65 first. This server has been running normally for several hours however I also went back from daisychaining to normal IpSwitch smtp32. If it all runs stable today then tonight I'll enable daisychaining again to make sure attachments via the webinterface get scanned. If all still runs normal on tuesday (monday is a holiday overhere) then I'll go bacl to 1.70 and see if the problem returs. If it does I'll enable the DECODE OFF option te see if that solves the problem. I'm also going to investigate the changes to the ip4r tests, to see if that may be the root of the problem. It *shouldn't* be, but then again there isn't anything in Declude JunkMail that *should* cause 100% CPU usage. :) Right, this setup has been rocksolid for two years so if it realy has been Declude which was responsible, then that's a first. ;-) Met vriendelijke groet, Bonno Bloksma --- [This E-mail scanned for viruses by Declude Virus using f-prot] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Processes Server Load
I have been experiencing high CPU loads lately as well, I reverted back to the release 1.65 but it is still doing it. I do not believe it is a declude issue. I dont know if this is related, maybe someone can explain here is what I am seeing when i do a netstat at the command prompt 62.145.51.3:59511 TIME_WAIT 62.175.27.221:1327 TIME_WAIT 62.175.27.221:1363 TIME_WAIT 62.175.27.221:1386 TIME_WAIT 62.175.27.221:1387 TIME_WAIT 210.22.204.55:25452TIME_WAIT 210.22.204.55:37665TIME_WAIT 210.83.133.50:3969 TIME_WAIT 210.103.68.2:1219 TIME_WAIT 210.103.68.2:4735 TIME_WAIT 210.117.98.25:2135 TIME_WAIT This is always going on during the CPU spikes They always step sequentially through the class A range These IP addresses are all sending spam Is this some new kind of spam method? I am seeing SPAM from ALOT of different IP address but each address is sending reletively small amounts of spam. As an experiment I blocked several class A's from apnic at the router level and my CPU troubles diminished as I blocked networks exibiting the above behavior. Rick Davidson Buckeye Internet Inc www.buckeyeweb.com 440-953-1900 ext: 222 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Processes Server Load
I dont know if this is related, maybe someone can explain here is what I am seeing when i do a netstat at the command prompt 62.145.51.3:59511 TIME_WAIT That just means that the IP 62.145.51.3 connected to your (from port 59511 on their side). The TIME_WAIT is there because the TCP/IP stack is required to keep the information on the connection for a few minutes. This does not indicate any problems. If you see a lot of these, it would just mean that there were a lot of recent connections to your mailserver. I am seeing SPAM from ALOT of different IP address but each address is sending reletively small amounts of spam. That isn't unusual -- spammers will often send from lots of different IPs (using compromised servers, or sometimes just lots of open proxies or open relays). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Processes Server Load
I see the same (with a very small domain and very light usage). The mail server is nowhere near the strongest, but is sometmies stressed with 1.70 (and was the same with 1.69b) but not 1.65. My recommendation for those that are experiencing this is to try adding a line DECODE OFF to the \IMail\Declude\global.cfg file, and see if this takes care of the problem. There were some base64 and HTML decoding functions added since 1.65, which use more CPU time than most Declude JunkMail functionality. They can be disabled with the DECODE OFF line. I'm also going to investigate the changes to the ip4r tests, to see if that may be the root of the problem. It *shouldn't* be, but then again there isn't anything in Declude JunkMail that *should* cause 100% CPU usage. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Processes Server Load
Kami, I'm running ten IP4r tests, referred to in my original email as an external DB query. There seems to be a descrepency between this as a cause and Scott's answer: the Declude process should not show high CPU usage in this case. Declude uses the Sleep() command, which gives up CPU cycles to other programs (and will prevent the Task Manager from showing CPU usage in Declude during idle times, such as when Declude JunkMail is waiting for an external or DNS-based test to complete). Assuming we're all talking about the same thing, Declude continues to run as a process waiting for replies from IP4r requests but does not consume much CPU time while doing so. Does pulling out IP4r tests during an episode show a immidiate decline in CPU use? Does anyone know how the people hosting the IP4r tests feel about us slamming them with queries? Suppose I'm cruising along with 20,000 queries a day, then jump to 500,000 over a few weeks, surely that makes an impression somewhere? Is there a point were we should ask about doing more? Thanks Dan On Wednesday, June 4, 2003 1:33, Kami Razvan [EMAIL PROTECTED] wrote: Hi Dan: We had a similar problem. I posted a couple of messages regarding this very issue. We were having CPU at 100% for minutes.. in one case when a mail list hit our server with a lot of users receiving the message at the same time the CPU was at 100% for almost an hour. We could not do anything... Finally the Declude processes disappeared and all was back to normal again. What I noticed was the cause more than anything else was the IP4r tests. Declude appears to be fast in filtering and everything that it does. The IP4r tests are a different story and naturally out of Declude hands. We had a lot of them and by taking them off it brought things to normal. I stated this in an earlier posting- we are not doing all of our IP4r tests in IMail version 8. It works much faster and since it caches it seems like it works great. We have about 60 IP4r tests (majority of what is listed in Declude/junkmail/manual.htm site. We will take some off and add others as we find their effectiveness but for now we are using a lot of them and no problem. I am interested to see if this helps you if you try it. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Tuesday, June 03, 2003 9:36 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude Processes Server Load We added about 350 users to our 2000+ user dual server configuration in the last week and were doing pretty well until this afternoon. Suddenly the CPU load graph stopped looking like its normal Donky Kong video game simulation (up and down) and more resembled a 100% highway with a few dips. Declude processes were taking quite a while to clear before finishing, to be replaced by another. I pulled out some multi thousand line tests and it nary made a dent. Just before bringing our 3rd server into the fold, things quieted down. While I've already ordered 2 new dual processor 1U's, I want to par down (if not eliminate) the variables invovled: 1) If an external DB query slowed things down, delaying each Declude process, would Declude still show high CPU consumption while waiting and would the graph still be pegged? If not, is there any situation external to my server that would? 2) Is it possible for Declude to be consuming CPU cycles while idling for some other reason? 3) If something else is running in the background, eating cyles, does Declude 'look' like its working harder? 4) If a user (or users) all received masses of attached files (say multi megabyte), would this slow things down in the way described? 5) When a new client reports having 30 users, whats the best way to decipher if this is the case? Is there a log analyzer that inventories unique addresses (understanding that 1 user can have many addresses). Thanks! Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Processes Server Load
Scott, The servers in question are not [yet] running Declude Virus so what happened should be a purely Declude JunkMail question. With as lean as Declude is, looks like the only way to test this is in the moment. During yesterdays moment, it was tuff to sit by turning off one test at a time, to see which it was, while clients were waiting for email. Is there a way to load test a server, generating activity across one, some or all tests to find bottle necks? The new servers will hopefully make it less likely to happen again but that will also hinder understanding. I'll just have to get more clients to load them down with. :) Thanks Dan On Wednesday, June 4, 2003 5:07, R. Scott Perry [EMAIL PROTECTED] wrote: Just before bringing our 3rd server into the fold, things quieted down. While I've already ordered 2 new dual processor 1U's, I want to par down (if not eliminate) the variables invovled: 1) If an external DB query slowed things down, delaying each Declude process, would Declude still show high CPU consumption while waiting and would the graph still be pegged? If not, is there any situation external to my server that would? No -- the Declude process should not show high CPU usage in this case. 2) Is it possible for Declude to be consuming CPU cycles while idling for some other reason? No. Declude uses the Sleep() command, which gives up CPU cycles to other programs (and will prevent the Task Manager from showing CPU usage in Declude during idle times, such as when Declude JunkMail is waiting for an external or DNS-based test to complete). 3) If something else is running in the background, eating cyles, does Declude 'look' like its working harder? Not that I am aware of. 4) If a user (or users) all received masses of attached files (say multi megabyte), would this slow things down in the way described? It could. However, in this case, the main CPU usage would be Declude Virus decoding the attachments. Even so, it should take a lot of large files to see 100% CPU usage for an extended period of time. 5) When a new client reports having 30 users, whats the best way to decipher if this is the case? Is there a log analyzer that inventories unique addresses (understanding that 1 user can have many addresses). In this case, you may want to try our free Domain Lister tool (at http://www.declude.com/tools ), which you can run from a command prompt as domlist -list, which will (among other things) list all the users/aliases for a domain. It doesn't show the count, however. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Processes Server Load
I truly wish I could explain it.. May be I am dreaming.. But what I see is Declude does not get to 100% CPU since we moved it to IMail to do IP4r. This morning for example I saw about 10 or so Declude processes.. One at 19%.. A lot at 0% and then jumping to 10% and going away some hit 100% for 1 second and disappeared. Before we were seeing 100% CPU staying for several seconds and then each one of the waiting processes hitting 100%. We could not even more the mouse.. It would move in steps.. Now we don't have that problem. Watching this is now my favorite pass time... A cup of coffee and watching CPU Declude processes.. Have to try it with beer.. Could be more fun.. But can't imagine anything be more fun! :) Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Wednesday, June 04, 2003 4:19 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude Processes Server Load Kami, I'm running ten IP4r tests, referred to in my original email as an external DB query. There seems to be a descrepency between this as a cause and Scott's answer: the Declude process should not show high CPU usage in this case. Declude uses the Sleep() command, which gives up CPU cycles to other programs (and will prevent the Task Manager from showing CPU usage in Declude during idle times, such as when Declude JunkMail is waiting for an external or DNS-based test to complete). Assuming we're all talking about the same thing, Declude continues to run as a process waiting for replies from IP4r requests but does not consume much CPU time while doing so. Does pulling out IP4r tests during an episode show a immidiate decline in CPU use? Does anyone know how the people hosting the IP4r tests feel about us slamming them with queries? Suppose I'm cruising along with 20,000 queries a day, then jump to 500,000 over a few weeks, surely that makes an impression somewhere? Is there a point were we should ask about doing more? Thanks Dan On Wednesday, June 4, 2003 1:33, Kami Razvan [EMAIL PROTECTED] wrote: Hi Dan: We had a similar problem. I posted a couple of messages regarding this very issue. We were having CPU at 100% for minutes.. in one case when a mail list hit our server with a lot of users receiving the message at the same time the CPU was at 100% for almost an hour. We could not do anything... Finally the Declude processes disappeared and all was back to normal again. What I noticed was the cause more than anything else was the IP4r tests. Declude appears to be fast in filtering and everything that it does. The IP4r tests are a different story and naturally out of Declude hands. We had a lot of them and by taking them off it brought things to normal. I stated this in an earlier posting- we are not doing all of our IP4r tests in IMail version 8. It works much faster and since it caches it seems like it works great. We have about 60 IP4r tests (majority of what is listed in Declude/junkmail/manual.htm site. We will take some off and add others as we find their effectiveness but for now we are using a lot of them and no problem. I am interested to see if this helps you if you try it. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Tuesday, June 03, 2003 9:36 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude Processes Server Load We added about 350 users to our 2000+ user dual server configuration in the last week and were doing pretty well until this afternoon. Suddenly the CPU load graph stopped looking like its normal Donky Kong video game simulation (up and down) and more resembled a 100% highway with a few dips. Declude processes were taking quite a while to clear before finishing, to be replaced by another. I pulled out some multi thousand line tests and it nary made a dent. Just before bringing our 3rd server into the fold, things quieted down. While I've already ordered 2 new dual processor 1U's, I want to par down (if not eliminate) the variables invovled: 1) If an external DB query slowed things down, delaying each Declude process, would Declude still show high CPU consumption while waiting and would the graph still be pegged? If not, is there any situation external to my server that would? 2) Is it possible for Declude to be consuming CPU cycles while idling for some other reason? 3) If something else is running in the background, eating cyles, does Declude 'look' like its working harder? 4) If a user (or users) all received masses of attached files (say multi megabyte), would this slow things down in the way described? 5) When a new client reports having 30 users, whats the best way to decipher if this is the case? Is there a log analyzer that inventories unique addresses (understanding that 1 user can have many addresses). Thanks! Dan --- [This E-mail
Re: [Declude.JunkMail] Declude Processes Server Load
I have noticed that using the v1.65 I never see Declude use more the 45% CPU. Using 1.70 Beta I see Declude Max the CPU's 100% Has anyone else seen the same. Fred - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 04, 2003 4:36 PM Subject: Re: [Declude.JunkMail] Declude Processes Server Load Assuming we're all talking about the same thing, Declude continues to run as a process waiting for replies from IP4r requests but does not consume much CPU time while doing so. That is correct. It should use very, very little CPU time while waiting for the results to come back. Does pulling out IP4r tests during an episode show a immidiate decline in CPU use? It shouldn't cause a noticeable decline in CPU use -- I can't explain Kami's results. Does anyone know how the people hosting the IP4r tests feel about us slamming them with queries? You're not. Specifically, they will see the same number of queries whether you are running IMail v8's anti-spam, Declude JunkMail's, or some other anti-spam solution. The reason for this is that your local DNS server will cache the results. Suppose I'm cruising along with 20,000 queries a day, then jump to 500,000 over a few weeks, surely that makes an impression somewhere? Is there a point were we should ask about doing more? There are some spam databases that request that heavy users (typically 100,000+ E-mails/day) do zone transfers (downloading the DNS data a couple times a day). However, if 80% of the lookups are cached, you're talking about 20,000 queries hitting the spam database for every 100,000 E-mails. The root DNS servers are able to handle up to tens of thousands of queries every second; DNS is very efficient. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Processes Server Load
Kami, Is your DNS that IMAIL/Declude uses local to you? Or are you using an upstream DNS? That many IPV4 tests may warrant this. We noticed a large performance boost by using a DNS on the local LAN. Just a thought - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 04, 2003 3:58 PM Subject: RE: [Declude.JunkMail] Declude Processes Server Load I truly wish I could explain it.. May be I am dreaming.. But what I see is Declude does not get to 100% CPU since we moved it to IMail to do IP4r. This morning for example I saw about 10 or so Declude processes.. One at 19%.. A lot at 0% and then jumping to 10% and going away some hit 100% for 1 second and disappeared. Before we were seeing 100% CPU staying for several seconds and then each one of the waiting processes hitting 100%. We could not even more the mouse.. It would move in steps.. Now we don't have that problem. Watching this is now my favorite pass time... A cup of coffee and watching CPU Declude processes.. Have to try it with beer.. Could be more fun.. But can't imagine anything be more fun! :) Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Wednesday, June 04, 2003 4:19 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude Processes Server Load Kami, I'm running ten IP4r tests, referred to in my original email as an external DB query. There seems to be a descrepency between this as a cause and Scott's answer: the Declude process should not show high CPU usage in this case. Declude uses the Sleep() command, which gives up CPU cycles to other programs (and will prevent the Task Manager from showing CPU usage in Declude during idle times, such as when Declude JunkMail is waiting for an external or DNS-based test to complete). Assuming we're all talking about the same thing, Declude continues to run as a process waiting for replies from IP4r requests but does not consume much CPU time while doing so. Does pulling out IP4r tests during an episode show a immidiate decline in CPU use? Does anyone know how the people hosting the IP4r tests feel about us slamming them with queries? Suppose I'm cruising along with 20,000 queries a day, then jump to 500,000 over a few weeks, surely that makes an impression somewhere? Is there a point were we should ask about doing more? Thanks Dan On Wednesday, June 4, 2003 1:33, Kami Razvan [EMAIL PROTECTED] wrote: Hi Dan: We had a similar problem. I posted a couple of messages regarding this very issue. We were having CPU at 100% for minutes.. in one case when a mail list hit our server with a lot of users receiving the message at the same time the CPU was at 100% for almost an hour. We could not do anything... Finally the Declude processes disappeared and all was back to normal again. What I noticed was the cause more than anything else was the IP4r tests. Declude appears to be fast in filtering and everything that it does. The IP4r tests are a different story and naturally out of Declude hands. We had a lot of them and by taking them off it brought things to normal. I stated this in an earlier posting- we are not doing all of our IP4r tests in IMail version 8. It works much faster and since it caches it seems like it works great. We have about 60 IP4r tests (majority of what is listed in Declude/junkmail/manual.htm site. We will take some off and add others as we find their effectiveness but for now we are using a lot of them and no problem. I am interested to see if this helps you if you try it. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Tuesday, June 03, 2003 9:36 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude Processes Server Load We added about 350 users to our 2000+ user dual server configuration in the last week and were doing pretty well until this afternoon. Suddenly the CPU load graph stopped looking like its normal Donky Kong video game simulation (up and down) and more resembled a 100% highway with a few dips. Declude processes were taking quite a while to clear before finishing, to be replaced by another. I pulled out some multi thousand line tests and it nary made a dent. Just before bringing our 3rd server into the fold, things quieted down. While I've already ordered 2 new dual processor 1U's, I want to par down (if not eliminate) the variables invovled: 1) If an external DB query slowed things down, delaying each Declude process, would Declude still show high CPU consumption while waiting and would the graph still be pegged? If not, is there any situation external to my server that would? 2) Is it possible for Declude to be consuming CPU cycles while idling for some other reason? 3) If something else is running in the background, eating cyles, does Declude 'look' like its working
Re: [Declude.JunkMail] Declude Processes Server Load
Thats interesting, I upgraded both of the problem servers to 1.70 two days (about 36 hours) before this hit. I'm going to see if I can switch back to 1.69iX to see if there is a difference. Dan On Wednesday, June 4, 2003 14:50, Frederick Samarelli [EMAIL PROTECTED] wrote: I have noticed that using the v1.65 I never see Declude use more the 45% CPU. Using 1.70 Beta I see Declude Max the CPU's 100% Has anyone else seen the same. Fred - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 04, 2003 4:36 PM Subject: Re: [Declude.JunkMail] Declude Processes Server Load Assuming we're all talking about the same thing, Declude continues to run as a process waiting for replies from IP4r requests but does not consume much CPU time while doing so. That is correct. It should use very, very little CPU time while waiting for the results to come back. Does pulling out IP4r tests during an episode show a immidiate decline in CPU use? It shouldn't cause a noticeable decline in CPU use -- I can't explain Kami's results. Does anyone know how the people hosting the IP4r tests feel about us slamming them with queries? You're not. Specifically, they will see the same number of queries whether you are running IMail v8's anti-spam, Declude JunkMail's, or some other anti-spam solution. The reason for this is that your local DNS server will cache the results. Suppose I'm cruising along with 20,000 queries a day, then jump to 500,000 over a few weeks, surely that makes an impression somewhere? Is there a point were we should ask about doing more? There are some spam databases that request that heavy users (typically 100,000+ E-mails/day) do zone transfers (downloading the DNS data a couple times a day). However, if 80% of the lookups are cached, you're talking about 20,000 queries hitting the spam database for every 100,000 E-mails. The root DNS servers are able to handle up to tens of thousands of queries every second; DNS is very efficient. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Processes Server Load
Hi; Our DNS is local. Same IP range and 2 racks above the mail server. We are also using IMail 8 with the cache DNS option- if that makes a difference with our configuration it is hard to say. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Newland Sent: Wednesday, June 04, 2003 5:18 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude Processes Server Load Kami, Is your DNS that IMAIL/Declude uses local to you? Or are you using an upstream DNS? That many IPV4 tests may warrant this. We noticed a large performance boost by using a DNS on the local LAN. Just a thought - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 04, 2003 3:58 PM Subject: RE: [Declude.JunkMail] Declude Processes Server Load I truly wish I could explain it.. May be I am dreaming.. But what I see is Declude does not get to 100% CPU since we moved it to IMail to do IP4r. This morning for example I saw about 10 or so Declude processes.. One at 19%.. A lot at 0% and then jumping to 10% and going away some hit 100% for 1 second and disappeared. Before we were seeing 100% CPU staying for several seconds and then each one of the waiting processes hitting 100%. We could not even more the mouse.. It would move in steps.. Now we don't have that problem. Watching this is now my favorite pass time... A cup of coffee and watching CPU Declude processes.. Have to try it with beer.. Could be more fun.. But can't imagine anything be more fun! :) Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Wednesday, June 04, 2003 4:19 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude Processes Server Load Kami, I'm running ten IP4r tests, referred to in my original email as an external DB query. There seems to be a descrepency between this as a cause and Scott's answer: the Declude process should not show high CPU usage in this case. Declude uses the Sleep() command, which gives up CPU cycles to other programs (and will prevent the Task Manager from showing CPU usage in Declude during idle times, such as when Declude JunkMail is waiting for an external or DNS-based test to complete). Assuming we're all talking about the same thing, Declude continues to run as a process waiting for replies from IP4r requests but does not consume much CPU time while doing so. Does pulling out IP4r tests during an episode show a immidiate decline in CPU use? Does anyone know how the people hosting the IP4r tests feel about us slamming them with queries? Suppose I'm cruising along with 20,000 queries a day, then jump to 500,000 over a few weeks, surely that makes an impression somewhere? Is there a point were we should ask about doing more? Thanks Dan On Wednesday, June 4, 2003 1:33, Kami Razvan [EMAIL PROTECTED] wrote: Hi Dan: We had a similar problem. I posted a couple of messages regarding this very issue. We were having CPU at 100% for minutes.. in one case when a mail list hit our server with a lot of users receiving the message at the same time the CPU was at 100% for almost an hour. We could not do anything... Finally the Declude processes disappeared and all was back to normal again. What I noticed was the cause more than anything else was the IP4r tests. Declude appears to be fast in filtering and everything that it does. The IP4r tests are a different story and naturally out of Declude hands. We had a lot of them and by taking them off it brought things to normal. I stated this in an earlier posting- we are not doing all of our IP4r tests in IMail version 8. It works much faster and since it caches it seems like it works great. We have about 60 IP4r tests (majority of what is listed in Declude/junkmail/manual.htm site. We will take some off and add others as we find their effectiveness but for now we are using a lot of them and no problem. I am interested to see if this helps you if you try it. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Tuesday, June 03, 2003 9:36 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude Processes Server Load We added about 350 users to our 2000+ user dual server configuration in the last week and were doing pretty well until this afternoon. Suddenly the CPU load graph stopped looking like its normal Donky Kong video game simulation (up and down) and more resembled a 100% highway with a few dips. Declude processes were taking quite a while to clear before finishing, to be replaced by another. I pulled out some multi thousand line tests and it nary made a dent. Just before bringing our 3rd server into the fold, things quieted down. While I've already ordered 2 new dual processor 1U's, I want to par down
[Declude.JunkMail] Declude Processes Server Load
We added about 350 users to our 2000+ user dual server configuration in the last week and were doing pretty well until this afternoon. Suddenly the CPU load graph stopped looking like its normal Donky Kong video game simulation (up and down) and more resembled a 100% highway with a few dips. Declude processes were taking quite a while to clear before finishing, to be replaced by another. I pulled out some multi thousand line tests and it nary made a dent. Just before bringing our 3rd server into the fold, things quieted down. While I've already ordered 2 new dual processor 1U's, I want to par down (if not eliminate) the variables invovled: 1) If an external DB query slowed things down, delaying each Declude process, would Declude still show high CPU consumption while waiting and would the graph still be pegged? If not, is there any situation external to my server that would? 2) Is it possible for Declude to be consuming CPU cycles while idling for some other reason? 3) If something else is running in the background, eating cyles, does Declude 'look' like its working harder? 4) If a user (or users) all received masses of attached files (say multi megabyte), would this slow things down in the way described? 5) When a new client reports having 30 users, whats the best way to decipher if this is the case? Is there a log analyzer that inventories unique addresses (understanding that 1 user can have many addresses). Thanks! Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Processes Server Load
Hi Dan: We had a similar problem. I posted a couple of messages regarding this very issue. We were having CPU at 100% for minutes.. in one case when a mail list hit our server with a lot of users receiving the message at the same time the CPU was at 100% for almost an hour. We could not do anything... Finally the Declude processes disappeared and all was back to normal again. What I noticed was the cause more than anything else was the IP4r tests. Declude appears to be fast in filtering and everything that it does. The IP4r tests are a different story and naturally out of Declude hands. We had a lot of them and by taking them off it brought things to normal. I stated this in an earlier posting- we are not doing all of our IP4r tests in IMail version 8. It works much faster and since it caches it seems like it works great. We have about 60 IP4r tests (majority of what is listed in Declude/junkmail/manual.htm site. We will take some off and add others as we find their effectiveness but for now we are using a lot of them and no problem. I am interested to see if this helps you if you try it. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Tuesday, June 03, 2003 9:36 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude Processes Server Load We added about 350 users to our 2000+ user dual server configuration in the last week and were doing pretty well until this afternoon. Suddenly the CPU load graph stopped looking like its normal Donky Kong video game simulation (up and down) and more resembled a 100% highway with a few dips. Declude processes were taking quite a while to clear before finishing, to be replaced by another. I pulled out some multi thousand line tests and it nary made a dent. Just before bringing our 3rd server into the fold, things quieted down. While I've already ordered 2 new dual processor 1U's, I want to par down (if not eliminate) the variables invovled: 1) If an external DB query slowed things down, delaying each Declude process, would Declude still show high CPU consumption while waiting and would the graph still be pegged? If not, is there any situation external to my server that would? 2) Is it possible for Declude to be consuming CPU cycles while idling for some other reason? 3) If something else is running in the background, eating cyles, does Declude 'look' like its working harder? 4) If a user (or users) all received masses of attached files (say multi megabyte), would this slow things down in the way described? 5) When a new client reports having 30 users, whats the best way to decipher if this is the case? Is there a log analyzer that inventories unique addresses (understanding that 1 user can have many addresses). Thanks! Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Processes Server Load
Just before bringing our 3rd server into the fold, things quieted down. While I've already ordered 2 new dual processor 1U's, I want to par down (if not eliminate) the variables invovled: 1) If an external DB query slowed things down, delaying each Declude process, would Declude still show high CPU consumption while waiting and would the graph still be pegged? If not, is there any situation external to my server that would? No -- the Declude process should not show high CPU usage in this case. 2) Is it possible for Declude to be consuming CPU cycles while idling for some other reason? No. Declude uses the Sleep() command, which gives up CPU cycles to other programs (and will prevent the Task Manager from showing CPU usage in Declude during idle times, such as when Declude JunkMail is waiting for an external or DNS-based test to complete). 3) If something else is running in the background, eating cyles, does Declude 'look' like its working harder? Not that I am aware of. 4) If a user (or users) all received masses of attached files (say multi megabyte), would this slow things down in the way described? It could. However, in this case, the main CPU usage would be Declude Virus decoding the attachments. Even so, it should take a lot of large files to see 100% CPU usage for an extended period of time. 5) When a new client reports having 30 users, whats the best way to decipher if this is the case? Is there a log analyzer that inventories unique addresses (understanding that 1 user can have many addresses). In this case, you may want to try our free Domain Lister tool (at http://www.declude.com/tools ), which you can run from a command prompt as domlist -list, which will (among other things) list all the users/aliases for a domain. It doesn't show the count, however. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
