Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Chris
On Tue, 2010-09-07 at 00:54 +0200, Karsten Bräckelmann wrote: > On Mon, 2010-09-06 at 17:32 -0500, Chris wrote: > > On Mon, 2010-09-06 at 17:03 +0200, Karsten Bräckelmann wrote: > > > > Unless the limit of 50k results in quite some spam ending up unprocessed > > > by SA, I doubt this will help. >

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Karsten Bräckelmann
On Mon, 2010-09-06 at 17:32 -0500, Chris wrote: > On Mon, 2010-09-06 at 17:03 +0200, Karsten Bräckelmann wrote: > > Unless the limit of 50k results in quite some spam ending up unprocessed > > by SA, I doubt this will help. > > > > Dropping large-ish third-party rule sets, if any, is much more li

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Chris
On Mon, 2010-09-06 at 17:03 +0200, Karsten Bräckelmann wrote: > On Sun, 2010-09-05 at 17:44 -0500, Chris wrote: > > Thanks for the input John, I can accept 30 or 45 seconds of drive access > > however when it comes to 300 I can't accept that. And you're absolutely > > correct, the problem is my lac

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Chris
On Mon, 2010-09-06 at 13:20 +0200, Matus UHLAR - fantomas wrote: > >> On Mon, 06 Sep 2010 12:26:08 +0200 > >> Yet Another Ninja wrote: > > >>> You're using the SA ClamAV plugin which isn't the most effcient > >>> method do do AV checks. > > > On 2010-09-06 12:49, RW wrote: > >> What's wrong with

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Chris
On Mon, 2010-09-06 at 13:14 +0200, Yet Another Ninja wrote: > On 2010-09-06 12:49, RW wrote: > > On Mon, 06 Sep 2010 12:26:08 +0200 > > Yet Another Ninja wrote: > > > > > >> You're using the SA ClamAV plugin which isn't the most effcient > >> method do do AV checks. > > > > What's wrong with it

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Chris
On Mon, 2010-09-06 at 12:09 +0200, Bernd Petrovitsch wrote: > On Son, 2010-09-05 at 17:44 -0500, Chris wrote: > > On Sun, 2010-09-05 at 12:54 -0700, John Hardin wrote: > > > On Sun, 5 Sep 2010, Chris wrote: > > > > > > > On Sun, 2010-09-05 at 12:33 -0500, Len Conrad wrote: > > > >>> Mem:772880

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread RW
On Mon, 06 Sep 2010 17:03:02 +0200 Karsten Bräckelmann wrote: > Since you mentioned procmail, your spamc calling recipe is *with* > locking, right? Limiting concurrent SA processes pretty much to one as > far as filtering is concerned. And start spamd with --max-children=1. That not only free

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Karsten Bräckelmann
On Sun, 2010-09-05 at 17:44 -0500, Chris wrote: > Thanks for the input John, I can accept 30 or 45 seconds of drive access > however when it comes to 300 I can't accept that. And you're absolutely > correct, the problem is my lack of memory I realize that now. > Just one user, me, though I alread

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread RW
On Mon, 6 Sep 2010 13:20:56 +0200 Matus UHLAR - fantomas wrote: > using clamav directly, without SA, is more effective. ClamAV plugin > seems to be OK for checking for things like phishes or strustured > data like credit card numbers, in which case it may cause false > positives. I don't see wh

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread John Hardin
On Mon, 6 Sep 2010, Martin Gregorie wrote: On Sun, 2010-09-05 at 14:55 -0500, Chris wrote: On Sun, 2010-09-05 at 20:02 +0200, Karsten Bräckelmann wrote: On Sat, 2010-09-04 at 08:42 -0500, Chris wrote: I'm trying to figure out why I'm having ridiculous scan times such as the above examples. Lo

Re: Limit message size scans

2010-09-06 Thread COGZ
Not that I know of. The solution needs unmodifiable by the users. John Hardin wrote: > > On Sun, 5 Sep 2010, COGZ wrote: > >> The problem with editing the users .mailfilter file is that they could >> overwrite it with their control panel. Seems like a shell script wrapper >> would be best. Any

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Matus UHLAR - fantomas
>> On Mon, 06 Sep 2010 12:26:08 +0200 >> Yet Another Ninja wrote: >>> You're using the SA ClamAV plugin which isn't the most effcient >>> method do do AV checks. > On 2010-09-06 12:49, RW wrote: >> What's wrong with it? On 06.09.10 13:14, Yet Another Ninja wrote: > nothing "wrong" but my first

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Yet Another Ninja
On 2010-09-06 12:49, RW wrote: On Mon, 06 Sep 2010 12:26:08 +0200 Yet Another Ninja wrote: You're using the SA ClamAV plugin which isn't the most effcient method do do AV checks. What's wrong with it? nothing "wrong" but my first choice would be to reject infected files at MTA level (via

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread RW
On Mon, 06 Sep 2010 12:26:08 +0200 Yet Another Ninja wrote: > You're using the SA ClamAV plugin which isn't the most effcient > method do do AV checks. What's wrong with it?

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Yet Another Ninja
On 2010-09-05 0:00, Chris wrote: On Sat, 2010-09-04 at 08:42 -0500, Chris wrote: I'm trying to figure out why I'm having ridiculous scan times such as the above examples. Lower scan times such as in the 20 second range are the exception rather than the rule. I'm running bind as a local caching n

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Martin Gregorie
On Sun, 2010-09-05 at 14:55 -0500, Chris wrote: > On Sun, 2010-09-05 at 20:02 +0200, Karsten Bräckelmann wrote: > > On Sat, 2010-09-04 at 08:42 -0500, Chris wrote: > > > I'm trying to figure out why I'm having ridiculous scan times such as > > > the above examples. Lower scan times such as in the 2

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-06 Thread Bernd Petrovitsch
On Son, 2010-09-05 at 17:44 -0500, Chris wrote: > On Sun, 2010-09-05 at 12:54 -0700, John Hardin wrote: > > On Sun, 5 Sep 2010, Chris wrote: > > > > > On Sun, 2010-09-05 at 12:33 -0500, Len Conrad wrote: > > >>> Mem:772880k total, 685316k used,87564k free,31344k buffers > > >>> Swap: