Josh Trutwin wrote:
> 
> Still having problems - even with -L.  Server has 1 GB of memory,
> more is on the way I hope.

You said previously that you were running 12 children.  With 1GB of
RAM, I would suggest that you drop it to 6 and see what happens.

> Anyway - I have the following rules:
> 
> fastconcepts:/etc/mail/spamassassin# ls
> 10_misc.cf                     88_FVGT_headers.cf
> 70_sare_adult.cf               88_FVGT_rawbody.cf
> 70_sare_bayes_poison_nxm.cf    88_FVGT_subject.cf
> 70_sare_evilnum0.cf            88_FVGT_uri.cf
> 70_sare_genlsubj.cf            99_FVGT_DomainDigits.cf
> 70_sare_header.cf              99_FVGT_meta.cf
> 70_sare_highrisk.cf            99_sare_fraud_post25x.cf
> 70_sare_html.cf                RulesDuJour
> 70_sare_obfu.cf                antidrug.cf
> 70_sare_oem.cf                 backhair.cf
> 70_sare_random.cf              bogus-virus-warnings.cf
> 70_sare_ratware.cf             chickenpox.cf
> 70_sare_specific.cf            coaching.cf
> 70_sare_spoof.cf               init.pre
> 70_sare_stocks.cf              local.cf
> 70_sare_unsub.cf               mr_wiggly.cf
> 70_sare_uri.cf                 random.cf
> 70_sare_uri0.cf                tripwire.cf
> 70_sare_whitelist_rcvd.cf      tsa-list.cf
> 70_sare_whitelist_spf.cf       useless.cf
> 72_sare_bml_post25x.cf         v310.pre
> 72_sare_redirect_post3.0.0.cf  v312.pre
> 88_FVGT_body.cf                weeds.cf
> 
> I created coaching.cf and tsa-list.cf - they are basically one
> (well two technically) liners.
> 
> If I need to cut back I'm not sure where to start - the SARE rules
> are the ones listed on rulesemporium.com - the FVGT are on
> http://www.exit0.us/index.php?pagename=RulesDuJourRuleSets.  Of the
> rest, only bogus-virus-warnings.cf is of any substantial size (and
> still 1/3 the size of the largest SARE rule).

antidrug.cf can be removed.  These rules are already included in the
latest SA versions.

70_sare_uri.cf and 70_sare_uri0.cf are overlapping.  You should use
one or the other, not both.  70_sare_uri.cf contains all of the SARE
uri rules.  70_sare_uri0.cf contains only the uri rules that did not
hit any ham during testing.

> Should v310.pre be removed if v312.pre is also there?

No, v312.pre contains plugins that were added with SA 3.1.2 and
v310.pre contains plugins added with SA 3.1.0.  You should not remove
any of these files.

-- 
Bowie

Reply via email to