W dniu 30.03.2011 16:34, Kris Deugau pisze: > My experience here has been that if a spamd child is pegging a CPU core > for an extended period, there's simply a *lot* of body text to run > (raw)body rules against (eg, ~ >200K). > > We've found that a fairly effective defense against this is to set up a > second spamd instance with ~20 high-scoring rules (Spamhaus, local > DNSBL, local and remote URI blacklists, Pyzor and/or Razor, plus one or > two "normal" rules) and do two scanning passes: > > -> call the second (lean) instance, skip further filtering if tagged. > This skims off ~80% of the junk (much of which would score >20 points > with the full ruleset) at *very* low CPU usage. > -> call the main instance on all remaining mail
This is interesting idea! I thought about configuration like this, but i think about SA with and without bayes. I'm still trying to avoid double instance of SA. I don't have big emails traffic, i have a little specific traffic. Regards
