RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message Mark: I might have missed it in case you mentioned it. What is your drive configuration? I believe that also can make a lot of difference. It is best to have your spool directory separate from your mailboxes. Our configuration is as follows: 1: RAID 0+1: OS Application 2: RAID 0+1: Spool 3: RAID 5: Mailboxes I believe performance increase can also be made if the Pagefile is separated and put in its own drive but we do not have it. I am not sure if in your case it will solve the problem but I have a feeling it can help. Regards, Kami -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 3:51 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing "\IMail\Declude -diag" from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the "CPU" column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message Hi Andrew: The X-IMAIL that you asked about has to do with the weights that we assign to each test. We are doing the IP4r tests in IMail and adding headers. Declude filter for these tests in the header has weights assigned to each test. 1: To start with: IMail kill.lst file does not allow the entries to send email to a user. "unacceptable mail address in MAIL FROM:" - so these emails never make it even to to the IP4r tests. 2: Email is not in the kill list: IMail does IP4r tests and adds header 3: Email makes it past IP4r tests in IMail: Header filter in Declude assigns weights to the header entries There was a lot of discussion about this a while back as to which is more efficient doing it in IMail or Declude. We did an analysis of the tests and finally concluded that if an email fails 10 of the IP4r tests it is 100% spam. This was done over 3 months and checking every spam. So now we have set the IMail 8 to delete any email that fails 13 of the IP4r tests. We have about 30 of them listed. This also reduces the load on the server since these emails ( there are a lot of them) never make it to Declude. On the average all of our tests have a weight of 5 - some are 1 and some are 8,10,14. If we take 5 as the average then 13 failed tests is equivalent to a weight of 65. We delete on 60 anyway so we feel safe with this action. As spammers get smarter our filter files keep growing in size and naturally Declude will have more and more to do. If we know something is getting deleted why bother Declude to check it? I hope that answers your question. Regards, Kami -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Thursday, July 24, 2003 5:16 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu Kami, you've mentioned your approach before but never so succinctly; thanks for sharing. I've been meaning to ask you why youadopted techniques1) and 2). Surely this is a longer way to do the same thing as IP4R/RBL tests in JM? 3) Does make good sense to me. I wonder if the same logic applies to 1) because you use "trusted blacklist" types to eliminate messages before they get to declude.exe? In which case, the X-IMAIL- header is irrelevant because IMail immediately deletes the message. Andrew. p.s. I haven't upgraded to IMail 8 yet; I'm planning on upgrading the hardware, IMail and JunkMail Pro all at the same time. -Original Message-From: Kami Razvan [mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003 1:31 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Declude using 50% cpu Hi; Let me share our experience and what we did to help it. 1: We put all the IP4r tests in IMail (of course version 8 if you have it) 2: Created a weight XHeader file and gave the header that appears for each test a weight. The following is a snapshot of what we have for the file: HEADERS 8 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-RUSSIAHEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-YIPESHEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (BLARSHEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (COMPUHEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DELINKHEADERS 6 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBLHEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBLALL 3: With IMail version8 we also moved the kill list to IMail from Declude. In previous versions IMail did not handle Kill lists very well but with 8 and the wild card we changed our kill list and moved to IMail. This helped a lot since emails are simply blocked at IMail level and never make it to Declude. This reduced a lot of load since Declude will never see an email from a blacklisted address. We know that Declude finishes everything it has to before taking the action, delete in this case, so if Declude will delete the message anyway why let it see it to start with? Of course these may not matter much to most but we have a lot of filter files so perhaps our imposed load is a tad out of ordinary. All these together - simply taking the best of both worlds - eased the load on the server. I am sure others have other experiences but this is our experience. Regards, Kami -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 4:05 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu Thanks for that info Andrew, however I am looking at the task manager for my box and even 1 declude process was taking 50% then it popped up another process with 45% granted these go away when the messages are finished, however this server passes a LOT of traffic, so the number of processes for imail is default (30), I hope it wouldnt use that ma
RE: [Declude.JunkMail] Declude using 50% cpu
Rifat, since you have the Pro version of JunkMail, how much text filtering do you do? Kami and I both do quite a bit... I just counted, and in various separate text filter files, i have 3500 BODY tests. Andrew. -Original Message- From: Rifat Levis [mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003 5:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu I am running single P3 1.0 Ghz with 2 scsi HD 1st Drive OS 2nd Drive Imail. Win2k , Sp4 , Imail 8.x with latest patches. Declude JunkPro , Virus with f-prot. ver 1.75 Webmail+pop3+smtp+imap4+DNS server Processor usage around 30% ,40% I didnt made any stats about the email volume , but more than 15.000 user are using it. Working without any problem :) The server bandwith usage is around 1Mbit/sec I will upgrade it someday ,not in hurry If it is working fine with me , there should be some other kind of problems. The cpu usage ,is heavy for DNS ,Webmail and other services but not for declude. Regards Rifat Levis - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 25, 2003 2:57 AM Subject: RE: [Declude.JunkMail] Declude using 50% cpu This server is slammed during buisness hours but it was making due with dual 933, declude just kills it. What portion of custom filters vs rdns checks should I look at to reduce this processing strain? A dual 933 should be able to process at about 200,000 E-mails/day complete with virus and spam scanning. At 27,000 E-mails/day, even if they were crammed into just 4 hours (27,000 in 4 hours, with none being sent in the other 20 hours), the server should still be able to handle it. In your case, I would suggest trying v1.65 (from http://www.declude.com/release/165/declude.exe ) -- you can just replace the \IMail\Declude.exe file, without making any configuration file changes. There were a couple reports of high CPU usage since 1.65, but nothing that turned out to be a definable problem. If the high CPU usage occurs on 1.75 but not 1.65, that would provide some big clues as to what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message
Ah, I do see why
you've moved the ip4r tests to IMail. I do remember that earlier
discussion of ip4r efficiency, but I didn't give it my full attention (I was
slogging through the backlog that came in while I was on vacation...) I had
concluded that the decision to move ip4r tests from Declude to IMail was
moot.
Now, however, I
do see the value, which is that you have another testing layer above Declude,
i.e. that you have IMail drop the message if it triggers 10 ip4r tests.
Thus giving you a second way to get weed out messages before they reach Declude
andyour heavy text filters (for new readers, the first way was via the
kill list).
Andrew
8)
-Original Message-From: Kami Razvan
[mailto:[EMAIL PROTECTED] Sent: Friday, July 25, 2003 5:23
AMTo: [EMAIL PROTECTED]Subject: RE:
[Declude.JunkMail] Declude using 50% cpu
Hi
Andrew:
The X-IMAIL that
you asked about has to do with the weights that we assign to each
test.
We are doing the
IP4r tests in IMail and adding headers. Declude filter for these tests
in the header has weights assigned to each test.
1: To
start with: IMail kill.lst file does not allow the entries to send email
to a user. "unacceptable mail address in MAIL FROM:" - so these emails
never make it even to to the IP4r tests.
2: Email
is not in the kill list: IMail does IP4r tests and adds
header
3: Email
makes it past IP4r tests in IMail: Header filter in Declude
assigns weights to the header entries
There was a lot
of discussion about this a while back as to which is more efficient doing it
in IMail or Declude. We did an analysis of the tests and finally
concluded that if an email fails 10 of the IP4r tests it is 100% spam.
This was done over 3 months and checking every spam. So now we have set
the IMail 8 to delete any email that fails 13 of the IP4r tests. We have
about 30 of them listed. This also reduces the load on the server since
these emails ( there are a lot of them) never make it to Declude.
On the average all of our tests have a weight of 5 - some are 1 and some are
8,10,14. If we take 5 as the average then 13 failed tests is equivalent
to a weight of 65. We delete on 60 anyway so we feel safe with this
action.
As spammers get
smarter our filter files keep growing in size and naturally Declude will have
more and more to do. If we know something is getting deleted why bother
Declude to check it?
I hope that
answers your question.
Regards,
Kami
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Colbeck, AndrewSent: Thursday, July 24, 2003
5:16 PMTo: '[EMAIL PROTECTED]'Subject: RE:
[Declude.JunkMail] Declude using 50% cpu
Kami, you've
mentioned your approach before but never so succinctly; thanks for
sharing. I've been meaning to ask you why youadopted
techniques1) and 2). Surely this is a longer way to do the same
thing as IP4R/RBL tests in JM?
3) Does make
good sense to me. I wonder if the same logic applies to 1) because you
use "trusted blacklist" types to eliminate messages before they get to
declude.exe? In which case, the X-IMAIL- header is irrelevant because
IMail immediately deletes the message.
Andrew.
p.s. I haven't
upgraded to IMail 8 yet; I'm planning on upgrading the hardware, IMail and
JunkMail Pro all at the same time.
-Original Message-From: Kami Razvan
[mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003
1:31 PMTo: [EMAIL PROTECTED]Subject: RE:
[Declude.JunkMail] Declude using 50% cpu
Hi;
Let me share
our experience and what we did to help it.
1: We
put all the IP4r tests in IMail (of course version 8 if you have
it)
2:
Created a weight XHeader file and gave the header that appears for each test
a weight. The following is a snapshot of what we have for the
file:
HEADERS
8
CONTAINS
X-IMAIL-SPAM-DNSBL:
(BHOLE-RUSSIAHEADERS
5
CONTAINS
X-IMAIL-SPAM-DNSBL:
(BHOLE-YIPESHEADERS
1
CONTAINS
X-IMAIL-SPAM-DNSBL:
(BLARSHEADERS
1
CONTAINS
X-IMAIL-SPAM-DNSBL:
(COMPUHEADERS
1
CONTAINS
X-IMAIL-SPAM-DNSBL:
(DELINKHEADERS
6
CONTAINS
X-IMAIL-SPAM-DNSBL:
(DSBLHEADERS
1
CONTAINS
X-IMAIL-SPAM-DNSBL: (DSBLALL
3: With
IMail version8 we also moved the
kill list to IMail from Declude. In previous versions IMail did not
handle Kill lists very well but with 8 and the wild card we changed our kill
list and moved to IMail. This helped a lot since emails are simply
blocked at IMail level and never make it to Declude. This reduced a
lot of load since Declude will never see an email from a blacklisted
address.
Re: [Declude.JunkMail] Declude using 50% cpu
You will be suprised to my response. I can not do a very strict blocking ,because this mail server serve the dial-up customers. I have only 2 line ,here is the 2 line HELO 20 contains OMMO.NET HELO 20 contains 212.64.200.32 these 2 line is direct delete , OMMO.net is used as helo msg from the biggest spammer in turkey ,this guy sells a cd with a Spam software. each software use ommo.net as hello .So 100% spam the 2nd line no need to comment . I refuse to scan body , it can catch legitime mail. rifat - Original Message - From: Colbeck, Andrew [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 25, 2003 8:24 PM Subject: RE: [Declude.JunkMail] Declude using 50% cpu Rifat, since you have the Pro version of JunkMail, how much text filtering do you do? Kami and I both do quite a bit... I just counted, and in various separate text filter files, i have 3500 BODY tests. Andrew. -Original Message- From: Rifat Levis [mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003 5:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu I am running single P3 1.0 Ghz with 2 scsi HD 1st Drive OS 2nd Drive Imail. Win2k , Sp4 , Imail 8.x with latest patches. Declude JunkPro , Virus with f-prot. ver 1.75 Webmail+pop3+smtp+imap4+DNS server Processor usage around 30% ,40% I didnt made any stats about the email volume , but more than 15.000 user are using it. Working without any problem :) The server bandwith usage is around 1Mbit/sec I will upgrade it someday ,not in hurry If it is working fine with me , there should be some other kind of problems. The cpu usage ,is heavy for DNS ,Webmail and other services but not for declude. Regards Rifat Levis - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 25, 2003 2:57 AM Subject: RE: [Declude.JunkMail] Declude using 50% cpu This server is slammed during buisness hours but it was making due with dual 933, declude just kills it. What portion of custom filters vs rdns checks should I look at to reduce this processing strain? A dual 933 should be able to process at about 200,000 E-mails/day complete with virus and spam scanning. At 27,000 E-mails/day, even if they were crammed into just 4 hours (27,000 in 4 hours, with none being sent in the other 20 hours), the server should still be able to handle it. In your case, I would suggest trying v1.65 (from http://www.declude.com/release/165/declude.exe ) -- you can just replace the \IMail\Declude.exe file, without making any configuration file changes. There were a couple reports of high CPU usage since 1.65, but nothing that turned out to be a definable problem. If the high CPU usage occurs on 1.75 but not 1.65, that would provide some big clues as to what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude using 50% cpu
We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing \IMail\Declude -diag from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the CPU column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message Mark, it may be interesting for you to note that we don't set the number of instances of Decludedirectly. Instead, the "max processes" limit in your IMail SMTP advanced settings is what governs the total number ofIMail and declude.exe instances. Also, an important infrastructure detail is that IMailcalls one declude.exe for each message (not recipient), and declude.exe quits after it is done. Watch Task Manager for a while, sort alphabetically, and watch the number of declude.exe instances come and note that their PIDs are always changing. When I first evaluated Declude JunkMail Pro, I had assumed it ran as a service and IMail passed it data as necessary. This was entirely wrong, so the previous two paragraphs would have been helpful to me. I hope they help you. Andrew 8) -Original Message-From: Mark Gordon [mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003 12:15 PMTo: '[EMAIL PROTECTED]'Subject: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing \IMail\Declude -diag from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the CPU column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: RE: [Declude.JunkMail] Declude using 50% cpu Where is your DNS server you are using in Imail? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Gordon Sent: Thursday, July 24, 2003 12:51 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing \IMail\Declude -diag from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the CPU column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: RE: [Declude.JunkMail] Declude using 50% cpu BTW, with an average CPU usage of 44% before Declude, you may be reaching the saturation point of the server. Not critical, but from my understanding if average CPU usage is at 50%, you need to start looking at things. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Gordon Sent: Thursday, July 24, 2003 12:51 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing \IMail\Declude -diag from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the CPU column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message Thanks for that info Andrew, however I am looking at the task manager for my box and even 1 declude process was taking 50% then it popped up another process with 45% granted these go away when the messages are finished, however this server passes a LOT of traffic, so the number of processes for imail is default (30), I hope it wouldnt use that many for it would kill the box. I let declude run for 2 hours and my monitors reported 95-100% cpu usage consistantly. -Original Message-From: Colbeck, Andrew [mailto:[EMAIL PROTECTED]Sent: Thursday, July 24, 2003 3:56 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu Mark, it may be interesting for you to note that we don't set the number of instances of Decludedirectly. Instead, the "max processes" limit in your IMail SMTP advanced settings is what governs the total number ofIMail and declude.exe instances. Also, an important infrastructure detail is that IMailcalls one declude.exe for each message (not recipient), and declude.exe quits after it is done. Watch Task Manager for a while, sort alphabetically, and watch the number of declude.exe instances come and note that their PIDs are always changing. When I first evaluated Declude JunkMail Pro, I had assumed it ran as a service and IMail passed it data as necessary. This was entirely wrong, so the previous two paragraphs would have been helpful to me. I hope they help you. Andrew 8) -Original Message-From: Mark Gordon [mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003 12:15 PMTo: '[EMAIL PROTECTED]'Subject: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down.
RE: [Declude.JunkMail] Declude using 50% cpu
On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 The problem here is most likely that your server is reaching its limit. If it was at around 44% previously (assuming that almost all of that is IMail related, primarily standard receiving/delivering of E-mails), seeing it at around 90% now is not unusual. One thing that you may want to try is adding a line DECODE OFF to the \IMail\Declude\global.cfg file, which will speed up processing a bit (at a cost of not letting you filter E-mails that have base64-encoded text/HTML segments, or E-mails with HTML code breaking up words/phrases that you filter on). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: RE: [Declude.JunkMail] Declude using 50% cpu Scott, is there any threshold for the number of custom filters vs the amount of time/cpu power required to parse such filters? I think that I may be passing it through to many filters before sending it out. -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing \IMail\Declude -diag from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the CPU column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude using 50% cpu
Title: RE: [Declude.JunkMail] Declude using 50% cpu Also, can we ask what hardware / OS this is running on? Jason - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Thursday, July 24, 2003 3:03 PM Subject: RE: [Declude.JunkMail] Declude using 50% cpu Where is your DNS server you are using in Imail? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 12:51 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing "\IMail\Declude -diag" from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the "CPU" column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: RE: [Declude.JunkMail] Declude using 50% cpu win2k sp3 dual 933 512K ram, but memory was never a problem, its a dedicated mail server nothing else -Original Message-From: Jason Newland [mailto:[EMAIL PROTECTED]Sent: Thursday, July 24, 2003 4:22 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Declude using 50% cpu Also, can we ask what hardware / OS this is running on? Jason - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Thursday, July 24, 2003 3:03 PM Subject: RE: [Declude.JunkMail] Declude using 50% cpu Where is your DNS server you are using in Imail? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 12:51 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing "\IMail\Declude -diag" from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the "CPU" column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message Hi; Let me share our experience and what we did to help it. 1: We put all the IP4r tests in IMail (of course version 8 if you have it) 2: Created a weight XHeader file and gave the header that appears for each test a weight. The following is a snapshot of what we have for the file: HEADERS 8 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-RUSSIAHEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-YIPESHEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (BLARSHEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (COMPUHEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DELINKHEADERS 6 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBLHEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBLALL 3: With IMail version we also moved the kill list to IMail from Declude. In previous versions IMail did not handle Kill lists very well but with 8 and the wild card we changed our kill list and moved to IMail. This helped a lot since emails are simply blocked at IMail level and never make it to Declude. This reduced a lot of load since Declude will never see an email from a blacklisted address. We know that Declude finishes everything it has to before taking the action, delete in this case, so if Declude will delete the message anyway why let it see it to start with? Of course these may not matter much to most but we have a lot of filter files so perhaps our imposed load is a tad out of ordinary. All these together - simply taking the best of both worlds - eased the load on the server. I am sure others have other experiences but this is our experience. Regards, Kami -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 4:05 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu Thanks for that info Andrew, however I am looking at the task manager for my box and even 1 declude process was taking 50% then it popped up another process with 45% granted these go away when the messages are finished, however this server passes a LOT of traffic, so the number of processes for imail is default (30), I hope it wouldnt use that many for it would kill the box. I let declude run for 2 hours and my monitors reported 95-100% cpu usage consistantly. -Original Message-From: Colbeck, Andrew [mailto:[EMAIL PROTECTED]Sent: Thursday, July 24, 2003 3:56 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu Mark, it may be interesting for you to note that we don't set the number of instances of Decludedirectly. Instead, the "max processes" limit in your IMail SMTP advanced settings is what governs the total number ofIMail and declude.exe instances. Also, an important infrastructure detail is that IMailcalls one declude.exe for each message (not recipient), and declude.exe quits after it is done. Watch Task Manager for a while, sort alphabetically, and watch the number of declude.exe instances come and note that their PIDs are always changing. When I first evaluated Declude JunkMail Pro, I had assumed it ran as a service and IMail passed it data as necessary. This was entirely wrong, so the previous two paragraphs would have been helpful to me. I hope they help you. Andrew 8) -Original Message-From: Mark Gordon [mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003 12:15 PMTo: '[EMAIL PROTECTED]'Subject: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down.
RE: [Declude.JunkMail] Declude using 50% cpu
Scott, is there any threshold for the number of custom filters vs the amount of time/cpu power required to parse such filters? I think that I may be passing it through to many filters before sending it out. That depends mostly on the type of filters -- for example, a filter that uses BODY would take a lot more time to process than one that uses SUBJECT (since the body is typically many times larger than the subject). The processing for the filtering is incremental, so that adding the second filter would use as much extra CPU time as adding the 1,000th filter (unlike files in directories, for example, where you have major slowdowns around 500-1000 files in a directory, and it isn't incremental). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: RE: [Declude.JunkMail] Declude using 50% cpu This server is slammed during buisness hours but it was making due with dual 933, declude just kills it. What portion of custom filters vs rdns checks should I look at to reduce this processing strain? -Original Message-From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED]Sent: Thursday, July 24, 2003 4:05 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Declude using 50% cpu BTW, with an average CPU usage of 44% before Declude, you may be reaching the saturation point of the server. Not critical, but from my understanding if average CPU usage is at 50%, you need to start looking at things. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 12:51 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing "\IMail\Declude -diag" from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the "CPU" column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message
Kami, you've
mentioned your approach before but never so succinctly; thanks for
sharing. I've been meaning to ask you why youadopted
techniques1) and 2). Surely this is a longer way to do the same
thing as IP4R/RBL tests in JM?
3) Does make good
sense to me. I wonder if the same logic applies to 1) because you use
"trusted blacklist" types to eliminate messages before they get to
declude.exe? In which case, the X-IMAIL- header is irrelevant because
IMail immediately deletes the message.
Andrew.
p.s. I haven't
upgraded to IMail 8 yet; I'm planning on upgrading the hardware, IMail and
JunkMail Pro all at the same time.
-Original Message-From: Kami Razvan
[mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003 1:31
PMTo: [EMAIL PROTECTED]Subject: RE:
[Declude.JunkMail] Declude using 50% cpu
Hi;
Let me share our
experience and what we did to help it.
1: We put
all the IP4r tests in IMail (of course version 8 if you have
it)
2: Created
a weight XHeader file and gave the header that appears for each test a
weight. The following is a snapshot of what we have for the
file:
HEADERS
8
CONTAINS
X-IMAIL-SPAM-DNSBL:
(BHOLE-RUSSIAHEADERS
5
CONTAINS
X-IMAIL-SPAM-DNSBL:
(BHOLE-YIPESHEADERS
1
CONTAINS
X-IMAIL-SPAM-DNSBL:
(BLARSHEADERS
1
CONTAINS
X-IMAIL-SPAM-DNSBL:
(COMPUHEADERS
1
CONTAINS
X-IMAIL-SPAM-DNSBL:
(DELINKHEADERS
6
CONTAINS
X-IMAIL-SPAM-DNSBL:
(DSBLHEADERS
1
CONTAINS
X-IMAIL-SPAM-DNSBL: (DSBLALL
3: With
IMail version8 we also moved the
kill list to IMail from Declude. In previous versions IMail did not
handle Kill lists very well but with 8 and the wild card we changed our kill
list and moved to IMail. This helped a lot since emails are simply
blocked at IMail level and never make it to Declude. This reduced a lot
of load since Declude will never see an email from a blacklisted
address. We know that Declude finishes everything it has to before
taking the action, delete in this case, so if Declude will delete the message
anyway why let it see it to start with?
Of course these
may not matter much to most but we have a lot of filter files so perhaps our
imposed load is a tad out of ordinary.
All these
together - simply taking the best of both worlds - eased the load on the
server.
I am sure others
have other experiences but this is our experience.
Regards,
Kami
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Mark GordonSent: Thursday, July 24, 2003 4:05
PMTo: '[EMAIL PROTECTED]'Subject: RE:
[Declude.JunkMail] Declude using 50% cpu
Thanks for that info Andrew, however I am looking at the task manager
for my box and even 1 declude process was taking 50% then it popped up another
process with 45% granted these go away when the messages are finished, however
this server passes a LOT of traffic, so the number of processes for imail is
default (30), I hope it wouldnt use that many for it would kill the box. I let
declude run for 2 hours and my monitors reported 95-100% cpu usage
consistantly.
-Original Message-From: Colbeck, Andrew
[mailto:[EMAIL PROTECTED]Sent: Thursday, July 24, 2003 3:56
PMTo: '[EMAIL PROTECTED]'Subject: RE:
[Declude.JunkMail] Declude using 50% cpu
Mark, it may
be interesting for you to note that we don't set the number of instances of
Decludedirectly. Instead, the "max processes" limit in your
IMail SMTP advanced settings is what governs the total number ofIMail
and declude.exe instances.
Also, an
important infrastructure detail is that IMailcalls one declude.exe for
each message (not recipient), and declude.exe quits after it is done. Watch
Task Manager for a while, sort alphabetically, and watch the number of
declude.exe instances come and note that their PIDs are always
changing.
When I first
evaluated Declude JunkMail Pro, I had assumed it ran as a service and IMail
passed it data as necessary. This was entirely wrong, so the previous
two paragraphs would have been helpful to me. I hope they help
you.
Andrew
8)
-Original Message-From: Mark Gordon
[mailto:[EMAIL PROTECTED] Sent: Thursday, July 24,
2003 12:15 PMTo:
'[EMAIL PROTECTED]'Subject: [Declude.JunkMail]
Declude using 50% cpu
We are evaluating declude and have noticed a considerable
increase in the cpu cycles associated with mail delivery. Is there anyway
have it run in an isolated cpu instance? since there are multiple
instances of declude.exe running, I would guess it would be hard to lock
it down.
h:RE: [Declude.JunkMail] Declude using 50% cpu
Title: RE: [Declude.JunkMail] Declude using 50% cpu I am very sorry but I have to ask, how did you get win2k to run on 512K of ram. :) On the serious side though, I really think there is an underlying problem here. Our mail server is a p4 1.6 with 1Gig of ram, with scsi hdds(Raid 5 with only 1 partition :( no I did not do the setup with only 1 partition it was given to me like that, it works, though it is a pita to defrag)and I really can not remember it EVER going over 20% utilization during regular business hours, though we only do 14,000 local deliveries and 4000 sends on an average day. We run declude antispam and IpSwitch's Antivirus(again not my idea I was pushing for Declude for the antivirus). Could it be a hdd speed issue/partition problem/fragment problem? Possibly a NIC problem, since Imail seems picky about the type of NIC that is used. Nathan Fouarge Amberwave Communications 114 N Dodge Algona, IA 50511 515-295-6900 x33 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 3:25 PMTo: '[EMAIL PROTECTED]' win2k sp3 dual 933512K rambut memory was never a problem, its a dedicated mail server nothing else -Original Message-From: Jason Newland [mailto:[EMAIL PROTECTED]Sent: Thursday, July 24, 2003 4:22 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Declude using 50% cpu Also, can we ask what hardware / OS this is running on? Jason - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Thursday, July 24, 2003 3:03 PM Subject: RE: [Declude.JunkMail] Declude using 50% cpu Where is your DNS server you are using in Imail? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 12:51 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing "\IMail\Declude -diag" from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the "CPU" column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
This server is slammed during buisness hours but it was making due with dual 933, declude just kills it. What portion of custom filters vs rdns checks should I look at to reduce this processing strain? A dual 933 should be able to process at about 200,000 E-mails/day complete with virus and spam scanning. At 27,000 E-mails/day, even if they were crammed into just 4 hours (27,000 in 4 hours, with none being sent in the other 20 hours), the server should still be able to handle it. In your case, I would suggest trying v1.65 (from http://www.declude.com/release/165/declude.exe ) -- you can just replace the \IMail\Declude.exe file, without making any configuration file changes. There were a couple reports of high CPU usage since 1.65, but nothing that turned out to be a definable problem. If the high CPU usage occurs on 1.75 but not 1.65, that would provide some big clues as to what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude using 50% cpu
I am running single P3 1.0 Ghz with 2 scsi HD 1st Drive OS 2nd Drive Imail. Win2k , Sp4 , Imail 8.x with latest patches. Declude JunkPro , Virus with f-prot. ver 1.75 Webmail+pop3+smtp+imap4+DNS server Processor usage around 30% ,40% I didnt made any stats about the email volume , but more than 15.000 user are using it. Working without any problem :) The server bandwith usage is around 1Mbit/sec I will upgrade it someday ,not in hurry If it is working fine with me , there should be some other kind of problems. The cpu usage ,is heavy for DNS ,Webmail and other services but not for declude. Regards Rifat Levis - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 25, 2003 2:57 AM Subject: RE: [Declude.JunkMail] Declude using 50% cpu This server is slammed during buisness hours but it was making due with dual 933, declude just kills it. What portion of custom filters vs rdns checks should I look at to reduce this processing strain? A dual 933 should be able to process at about 200,000 E-mails/day complete with virus and spam scanning. At 27,000 E-mails/day, even if they were crammed into just 4 hours (27,000 in 4 hours, with none being sent in the other 20 hours), the server should still be able to handle it. In your case, I would suggest trying v1.65 (from http://www.declude.com/release/165/declude.exe ) -- you can just replace the \IMail\Declude.exe file, without making any configuration file changes. There were a couple reports of high CPU usage since 1.65, but nothing that turned out to be a definable problem. If the high CPU usage occurs on 1.75 but not 1.65, that would provide some big clues as to what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message Mark, you might check if your C:\IMail\Spool\Overflow contains may Q*.SMD files, which will tell you whether you have a mail processing backlog. A busy server is one thing, and a burdened server is another. You can read: http://www.declude.com/dq.htm for the how and why of this overflow folder. Also, you can run Performance Monitor and check the System object, processor queue length. The suggestion is that a consistent value of more than 10 is a significant CPU bottleneck. Heck, just running administrative type applications on the desktop will probably tell you that! Andrew. -Original Message-From: Mark Gordon [mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003 1:08 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu This server is slammed during buisness hours but it was making due with dual 933, declude just kills it. What portion of custom filters vs rdns checks should I look at to reduce this processing strain? -Original Message-From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED]Sent: Thursday, July 24, 2003 4:05 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Declude using 50% cpu BTW, with an average CPU usage of 44% before Declude, you may be reaching the saturation point of the server. Not critical, but from my understanding if average CPU usage is at 50%, you need to start looking at things. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark GordonSent: Thursday, July 24, 2003 12:51 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude using 50% cpu On a good day we rev 19000 local deliveries + send 8000 per day. It hits the machine hard average cpu time before was around 44% then when declude was installed it jumped to over 90% average. The version is 1.75 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 24, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50% cpu We are evaluating declude and have noticed a considerable increase in the cpu cycles associated with mail delivery. Is there anyway have it run in an isolated cpu instance? since there are multiple instances of declude.exe running, I would guess it would be hard to lock it down. How many E-mails do you send/receive per day? What version of Declude are you running (you can find out by typing "\IMail\Declude -diag" from a command prompt)? Are you sure that it is Declude using the extra CPU cycles (by sorting the processes in the Task Manager by the "CPU" column)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude using 50% cpu
Title: Message
FYI, I have a
single mail relay with no mail boxes. RunsIMail like a champin a stripped
down Windows XPin a SCSI based
Compaqserver PII 333 MHz and
160 MB of RAM (plenty), but with the text filtering we do, we get a
consistentoverflow every day during peak hours. We've reduced our
IMail 7.x (and declude.exe v1.65) "max processes" value down from the default 25
to 12 to compensate. We have to add CPU power soon, and are currently
trying to figure out what to implement.
Our message
volume is10,500 inbound, and
we'reholding about 33% of that as spam with pretty well zero reported
false positives. Outbound is about 4,500 connections (messages will be a
little higher).
Andrew.
-Original Message-From: Mark Gordon
[mailto:[EMAIL PROTECTED] Sent: Thursday, July 24, 2003
1:08 PMTo: '[EMAIL PROTECTED]'Subject: RE:
[Declude.JunkMail] Declude using 50% cpu
This
server is slammed during buisness hours but it was making due with dual 933,
declude just kills it. What portion of custom filters vs rdns checks should I
look at to reduce this processing strain?
-Original Message-From: John Tolmachoff (Lists)
[mailto:[EMAIL PROTECTED]Sent: Thursday, July 24,
2003 4:05 PMTo: [EMAIL PROTECTED]Subject:
RE: [Declude.JunkMail] Declude using 50% cpu
BTW, with an
average CPU usage of 44% before Declude, you may be reaching the saturation
point of the server. Not critical, but from my understanding if average CPU
usage is at 50%, you need to start looking at things.
John Tolmachoff MCSE
CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original
Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mark GordonSent: Thursday, July 24,
2003 12:51
PMTo:
'[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Declude
using 50% cpu
On a
good day we rev 19000 local deliveries + send 8000 per day.
It hits
the machine hard average cpu time before was around 44% then when declude
was installed it jumped to over 90% average. The version is
1.75
-Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Thursday, July 24,
2003
3:37
PM To:
[EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude using 50%
cpu
We
are evaluating declude and have noticed a considerable increase in the
cpu cycles
associated with mail delivery. Is there anyway have it run in
an isolated
cpu instance? since there are multiple instances of declude.exe running, I would guess
it would be hard to lock it down.
How
many E-mails do you send/receive per day?
What
version of Declude are you running (you can find out by typing
"\IMail\Declude
-diag" from a command prompt)?
Are you
sure that it is Declude using the extra CPU cycles (by sorting the
processes in
the Task Manager by the "CPU" column)?
-Scott --- Declude JunkMail: The advanced anti-spam solution
for IMail mailservers. Declude Virus: Catches known viruses and is the
leader in mailserver vulnerability detection. Find out what you have been missing:
Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude
Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing
list. To unsubscribe, just send an E-mail to
[EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The
archives can be found at http://www.mail-archive.com.
