Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread Kris Deugau
Karsten Bräckelmann wrote: However, using (?:\s|\ )* also does the trick. Yes, keeping the nasty asterisk quantifier. The difference is merely dropping the \n from the alternation, which is part of \s whitespace anyway. Wondering if this is a case where Perl fails to optimize out the \n. Which w

Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread Karsten Bräckelmann
On Fri, 2011-05-27 at 13:14 -0400, Kris Deugau wrote: > Karsten Bräckelmann wrote: > > Yes, that sounds like the culprit indeed is one or more custom rule. If > > that "much faster" equals twice as fast, > > Probably closer to 4-6x; dual PIII/866 -> Core i3 3GHz. Sure -- that "twice" assumption

Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread Kris Deugau
John Hardin wrote: On Thu, 26 May 2011, Kris Deugau wrote: Whitelisting these once they're found lets them bypass SA altogether, but in the meantime they get stuck in the mail queue. Has anyone got any suggestions for decreasing the load SA imposes trying to process one of these? Any possibi

Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread Kris Deugau
Karsten Bräckelmann wrote: On Fri, 2011-05-27 at 10:38 -0400, Kris Deugau wrote: Mmmm. I don't *think* so, but testing the message on a stock SA 3.3.1 took "only" a minute (on slow hardware) vs 13 (on my much faster desktop). The latter being the production system with the custom rules, or at

Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread Karsten Bräckelmann
On Fri, 2011-05-27 at 10:38 -0400, Kris Deugau wrote: > Karsten Bräckelmann wrote: > > > However, we've just had a couple of *legitimate* messages get stuck for > > > essentially the same reason - a whole lot of pathologically bad HTML. > > > > Rings a bell. Such reports usually turned out to be ca

Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread darxus
On 05/27, John Hardin wrote: > Yes. "*" is "zero or more, unbounded" and "+" is "one or more, unbounded". > > It's much better to have an upper limit in body and rawbody rules, > e.g. {0,80} or {1,80} > > The upper limit may need some experimentation to set in specific > cases, but even so, {0,25

Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread John Hardin
On Fri, 27 May 2011, Kris Deugau wrote: I have a couple of instances of [a-z]+ and similar; is that effectively as troublesome as .+ or .*? Yes. "*" is "zero or more, unbounded" and "+" is "one or more, unbounded". It's much better to have an upper limit in body and rawbody rules, e.g. {0,8

Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread David F. Skoll
On Fri, 27 May 2011 10:38:17 -0400 Kris Deugau wrote: > I have a couple of instances of [a-z]+ and similar; is that > effectively as troublesome as .+ or .*? It could be, depending on what else is in the regex. There's a fairly nice Wikipedia article about evil regexes: http://en.wikipedia.or

Re: Large (usually legitimate) HTML mails choking SA

2011-05-27 Thread Kris Deugau
Karsten Bräckelmann wrote: On Thu, 2011-05-26 at 15:02 -0400, Kris Deugau wrote: Every so often we get a message or two stuck in our inbound mail queue because it took too long for SA to process during mail delivery. However, we've just had a couple of *legitimate* messages get stuck for esse

Re: "day old bread" DNSBL

2011-05-27 Thread Ken A
yes. URIBL_RHS_DOB is somewhat useful. It's not _very_ reliable alone though, so I use it with META rules that add points for combinations with other things that are common with uri type spam. It seems to hit much of the same things as fresh.spameatingmonkey.net ymmv. Ken On 5/27/2011 3:17

"day old bread" DNSBL

2011-05-27 Thread Andreas Schulze
Hi all, yesterday I learned about "day old bread", a list of domains registered in the last five day. I found informations from 2007: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200704.mbox/<4615e4b7.5010...@inetmsg.com> Has anybody current experiences ?? Thanks -- Viele Grüß