Re: [Declude.JunkMail] High CPU usage
We turned on the ipblacklist and domainblacklist and populated them from a couple of pretty good sources last Thursday and all of a sudden we were not getting anywhere close to the amount of spam, however some customers who use ColdFusion started not getting much of their email. Also our dual process or email server went from being used at about 35% to well over 90 and at certain times 100% sustained. causing backups on delivery of email. the IPblacklist is about 90k and the dmainblacklist is about 641k. We only have about 28000 incoming and 18000 outgoing emails per day. Any clues as to why this might be happening? It's happening because you've added a large amount to what Declude JunkMail has to do. A 90K IP blacklist is about 6,000 IPs, and a 641K domain blacklist is about 30,000 domains. That means that for every E-mail that comes in, Declude JunkMail has to compare the IP with 6,000 IP ranges and compare the return address with 30,000 different domains. That's going to take some time. I am surprised that it is using up so much CPU time. Are those IP blacklists and sender blacklists (ipfile and fromfile), or are those filters (if the domain blacklist is set up as a body filter, it would account for the very high CPU usage)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] High CPU usage
ipfile and fromfile Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 1:06 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] High CPU usage We turned on the ipblacklist and domainblacklist and populated them from a couple of pretty good sources last Thursday and all of a sudden we were not getting anywhere close to the amount of spam, however some customers who use ColdFusion started not getting much of their email. Also our dual process or email server went from being used at about 35% to well over 90 and at certain times 100% sustained. causing backups on delivery of email. the IPblacklist is about 90k and the dmainblacklist is about 641k. We only have about 28000 incoming and 18000 outgoing emails per day. Any clues as to why this might be happening? It's happening because you've added a large amount to what Declude JunkMail has to do. A 90K IP blacklist is about 6,000 IPs, and a 641K domain blacklist is about 30,000 domains. That means that for every E-mail that comes in, Declude JunkMail has to compare the IP with 6,000 IP ranges and compare the return address with 30,000 different domains. That's going to take some time. I am surprised that it is using up so much CPU time. Are those IP blacklists and sender blacklists (ipfile and fromfile), or are those filters (if the domain blacklist is set up as a body filter, it would account for the very high CPU usage)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] High CPU usage
ipfile and fromfile I just tested here, and a 600K fromfile caused about 50ms of CPU usage on a 2GHz CPU server. The 90K ipfile didn't show any noticeable CPU usage. Even on a 1GHz CPU with 100,000 E-mails/day, that would only account for about 10% of the CPU usage. I would recommend disabling both one at a time, to see if one of them specifically is causing the high CPU usage. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] High CPU usage
Thanks I have disabled both and still have high CPU usage. I run inoculate as my virus protection as well but do not think it is really the problem. I viewed the processes and I am still seeing 40 to 60 simultaneous declude calls with the same number of inoculate calls. The machine is a dual 866 machine with a gig of ram. Ram usage is 256m of 1g total. I am also running diskkeeper 8.0 and the machine is Windows 2000 server with the latest service packs. Does that help in maybe figuring what the culprit might be? By the way this just started like last Thursday when I upgraded to 1.79 on Declude and added the ipfile and fromfile. Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 4:43 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] High CPU usage ipfile and fromfile I just tested here, and a 600K fromfile caused about 50ms of CPU usage on a 2GHz CPU server. The 90K ipfile didn't show any noticeable CPU usage. Even on a 1GHz CPU with 100,000 E-mails/day, that would only account for about 10% of the CPU usage. I would recommend disabling both one at a time, to see if one of them specifically is causing the high CPU usage. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] High CPU usage
Thanks I have disabled both and still have high CPU usage. I run inoculate as my virus protection as well but do not think it is really the problem. In that case, you can go to the Task Manager, click on the Processes tab, and then click the CPU button. That will sort the processes by CPU usage, with the offender(s) at the top. I viewed the processes and I am still seeing 40 to 60 simultaneous declude calls with the same number of inoculate calls. Did you make any DNS changes (switching DNS servers in the IMail SMTP settings, for example)? That could cause the Declude.exe processes to stay in memory. Are viruses getting caught? If inoculate is not responding, the processes would stay in memory a long time (and viruses would not get caught). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] High CPU usage
SMTP is the culprit here. I can shut down declude and the usage is still at 100%. No DNS changes have been made. Viruses are being caught at the rate of about 1100 every 3 hours. Is there any know issue on Imail that you know of on smtp. I am running version 8.05 Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 5:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] High CPU usage Thanks I have disabled both and still have high CPU usage. I run inoculate as my virus protection as well but do not think it is really the problem. In that case, you can go to the Task Manager, click on the Processes tab, and then click the CPU button. That will sort the processes by CPU usage, with the offender(s) at the top. I viewed the processes and I am still seeing 40 to 60 simultaneous declude calls with the same number of inoculate calls. Did you make any DNS changes (switching DNS servers in the IMail SMTP settings, for example)? That could cause the Declude.exe processes to stay in memory. Are viruses getting caught? If inoculate is not responding, the processes would stay in memory a long time (and viruses would not get caught). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] High CPU usage
Is SMTP32.exe running at 100% or is it the total processor utilization? I'm not sure how you might "shut down Declude" unless you change the SMTP service to not call it and stop and restart it. Your previous message strongly suggested that your virus scanner isn't responding properly and that would be the first place to look. We're doing about 35,000 messages a day and Monday set a record for viruses which probably came in around 6,000. I would consider that volume of viruses to be out of the ordinary, but Netsky loves to send huge numbers of messages, with many going to invalid addresses that it parses from Message-ID's. You might try turning off the nobody alias if this is the case. Another strong suggestion would be to use F-Prot instead of Inoculate. My testing of various virus scanners with Declude showed F-Prot to be MUCH more efficient (the version that you pay for). That might solve your problem right there. F-Prot is cheap and it's the best command line scanner around when it comes to efficiency, hands down. With similar traffic on my server, and it being similar in size (a little more powerful), it would croak no doubt about it with a blacklist of 30,000 entries, in fact with a total of less than 5,000 lines of matches of various types, it couldn't manage if it wasn't for SKIPIFWEIGHT which defeats most of the filters about 70% of the time (not possible with ipfiles and fromfiles, though they are much leaner than body searches). Just throwing out a few ideas. Matt Rick Hogue wrote: SMTP is the culprit here. I can shut down declude and the usage is still at 100%. No DNS changes have been made. Viruses are being caught at the rate of about 1100 every 3 hours. Is there any know issue on Imail that you know of on smtp. I am running version 8.05 Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 5:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] High CPU usage Thanks I have disabled both and still have high CPU usage. I run inoculate as my virus protection as well but do not think it is really the problem. In that case, you can go to the Task Manager, click on the Processes tab, and then click the CPU button. That will sort the processes by CPU usage, with the offender(s) at the top. I viewed the processes and I am still seeing 40 to 60 simultaneous declude calls with the same number of inoculate calls. Did you make any DNS changes (switching DNS servers in the IMail SMTP settings, for example)? That could cause the Declude.exe processes to stay in memory. Are viruses getting caught? If inoculate is not responding, the processes would stay in memory a long time (and viruses would not get caught). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] High CPU usage
If I turn off SMTP my processor utilization is around 3 percent. With SMTP turned on and Declude turned off SMTP is at 99% with Declude on it is 100% So I kind of doubt that it is Declude even with the large lists I am using. Thanks for the advice on F-Prot I will look into that as a possibility. I like Innoculate but it is a bear to configure. If it had not been for Scott I would really have been in a mess with it. I just checked the processors on that system and now I am running at between 20 and 45% rather than the 100 I have been for the past 4 days. I guess I am going to have to look through snoop to see what it possibly could be. Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Wednesday, April 28, 2004 7:22 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] High CPU usage Is SMTP32.exe running at 100% or is it the total processor utilization? I'm not sure how you might "shut down Declude" unless you change the SMTP service to not call it and stop and restart it. Your previous message strongly suggested that your virus scanner isn't responding properly and that would be the first place to look. We're doing about 35,000 messages a day and Monday set a record for viruses which probably came in around 6,000. I would consider that volume of viruses to be out of the ordinary, but Netsky loves to send huge numbers of messages, with many going to invalid addresses that it parses from Message-ID's. You might try turning off the nobody alias if this is the case. Another strong suggestion would be to use F-Prot instead of Inoculate. My testing of various virus scanners with Declude showed F-Prot to be MUCH more efficient (the version that you pay for). That might solve your problem right there. F-Prot is cheap and it's the best command line scanner around when it comes to efficiency, hands down.With similar traffic on my server, and it being similar in size (a little more powerful), it would croak no doubt about it with a blacklist of 30,000 entries, in fact with a total of less than 5,000 lines of matches of various types, it couldn't manage if it wasn't for SKIPIFWEIGHT which defeats most of the filters about 70% of the time (not possible with ipfiles and fromfiles, though they are much leaner than body searches).Just throwing out a few ideas.MattRick Hogue wrote: SMTP is the culprit here. I can shut down declude and the usage is still at 100%. No DNS changes have been made. Viruses are being caught at the rate of about 1100 every 3 hours. Is there any know issue on Imail that you know of on smtp. I am running version 8.05 Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 5:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] High CPU usage Thanks I have disabled both and still have high CPU usage. I run inoculate as my virus protection as well but do not think it is really the problem. In that case, you can go to the Task Manager, click on the Processes tab, and then click the CPU button. That will sort the processes by CPU usage, with the offender(s) at the top. I viewed the processes and I am still seeing 40 to 60 simultaneous declude calls with the same number of inoculate calls. Did you make any DNS changes (switching DNS servers in the IMail SMTP settings, for example)? That could cause the Declude.exe processes to stay in memory. Are viruses getting caught? If inoculate is not responding, the processes would stay in memory a long time (and viruses would not get caught). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters
Re: [Declude.JunkMail] High CPU Usage
I am seeing a really high CPU usage for Declude. Anywhere between 35 - 55 % utilization. Is this normal? Is there tuning for Declude to reduce this usage (turning off logging, IGNORE instead of WARN in default junkmail file). Thanks. I am running NT 4.0, Declude 1.46, and Imail 6.06. The CPU usage you are seeing seems very high (unless you are using the DEBUG mode, which could account for high CPU usage). How long does the high CPU usage last? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] High CPU Usage
Not only that, but what traffic are you seeing and what is your hardware? Aaron Caviglia [EMAIL PROTECTED] - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, May 06, 2002 9:37 AM Subject: Re: [Declude.JunkMail] High CPU Usage I am seeing a really high CPU usage for Declude. Anywhere between 35 - 55 % utilization. Is this normal? Is there tuning for Declude to reduce this usage (turning off logging, IGNORE instead of WARN in default junkmail file). Thanks. I am running NT 4.0, Declude 1.46, and Imail 6.06. The CPU usage you are seeing seems very high (unless you are using the DEBUG mode, which could account for high CPU usage). How long does the high CPU usage last? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
