From: "David B Funk" <[EMAIL PROTECTED]>
> On Mon, 22 Mar 2004, Paolo Cravero as2594 wrote:
>
> > Hi.
> > An exceptionally high load of incoming messages has managed to crash
> > spamd (Postfix + SpamAssassin 2.62 on a dual Xeon 2G4).
> >
> > Is there a crontab script that monitors spamd health and in case
> > attempts a restart and/or warns a sysadmin?
> >
> > For those interested, Murphy made this happen on Friday night so
> > until Monday morning half of incoming mail was not spam-filtered (we're
> > running under load balancing). They were about 2500 msg/h (41 msg/min)
> > incoming generated by a vacation-reply loop (vacation reply to an
> > unknown mailbox, bounce, vacation reply to bounce, etc etc).
>
> I can't help you with the stay-alive script, but have another
> type of suggestion. Check your Postfix to see if it has some kind
> of rate/load limiting feature. (IE configure it to deny or queue-only
> if the incoming connections get above a certain rate, or if the
> load/resource usage gets to high).
> We use sendmail and I've got it configured with rate limit thresholds
> to defend spamd from mail-bomb attacks (externally or internally
> generated ;).
> Reasonable rate limiting has totally cured our SA from overload deaths.
>
> One other trick to survive forward-loops or reply-ping-pongs, configure
> your system so that if you've SA filtered a given message once, skip
> it if you see it again. (IE if it already has a SA header added by
> your system, don't bother to filter it again).
Of course, a forged spamassassin pass is going to be tried "RSN", I betcha.
{^_-}
