On Thu, 24 Aug 2006 10:11:28 -0400 Bowie Bailey <[EMAIL PROTECTED]> wrote:
> Josh Trutwin wrote: > > > > Still having problems - even with -L. Server has 1 GB of > > memory, more is on the way I hope. > > You said previously that you were running 12 children. With 1GB > of RAM, I would suggest that you drop it to 6 and see what > happens. Thanks - I had backed off to 8, still had probs so now I'm at 4. > > Anyway - I have the following rules: > > > > fastconcepts:/etc/mail/spamassassin# ls > > 10_misc.cf 88_FVGT_headers.cf > > 70_sare_adult.cf 88_FVGT_rawbody.cf > > 70_sare_bayes_poison_nxm.cf 88_FVGT_subject.cf > > 70_sare_evilnum0.cf 88_FVGT_uri.cf > > 70_sare_genlsubj.cf 99_FVGT_DomainDigits.cf > > 70_sare_header.cf 99_FVGT_meta.cf > > 70_sare_highrisk.cf 99_sare_fraud_post25x.cf > > 70_sare_html.cf RulesDuJour > > 70_sare_obfu.cf antidrug.cf > > 70_sare_oem.cf backhair.cf > > 70_sare_random.cf bogus-virus-warnings.cf > > 70_sare_ratware.cf chickenpox.cf > > 70_sare_specific.cf coaching.cf > > 70_sare_spoof.cf init.pre > > 70_sare_stocks.cf local.cf > > 70_sare_unsub.cf mr_wiggly.cf > > 70_sare_uri.cf random.cf > > 70_sare_uri0.cf tripwire.cf > > 70_sare_whitelist_rcvd.cf tsa-list.cf > > 70_sare_whitelist_spf.cf useless.cf > > 72_sare_bml_post25x.cf v310.pre > > 72_sare_redirect_post3.0.0.cf v312.pre > > 88_FVGT_body.cf weeds.cf > > > > I created coaching.cf and tsa-list.cf - they are basically one > > (well two technically) liners. > > > > If I need to cut back I'm not sure where to start - the SARE > > rules are the ones listed on rulesemporium.com - the FVGT are on > > http://www.exit0.us/index.php?pagename=RulesDuJourRuleSets. Of > > the rest, only bogus-virus-warnings.cf is of any substantial > > size (and still 1/3 the size of the largest SARE rule). > > antidrug.cf can be removed. These rules are already included in > the latest SA versions. Thanks - done. This should probably be removed from the rules_du_jour script then or marked Deprecated. I also was able to remove mr_wrigley.cf. > 70_sare_uri.cf and 70_sare_uri0.cf are overlapping. You should > use one or the other, not both. 70_sare_uri.cf contains all of > the SARE uri rules. 70_sare_uri0.cf contains only the uri rules > that did not hit any ham during testing. That's strange - 70_sare_uri.cf is not even available on the rules emporium page anymore - must've been downloaded before it was split. I removed em both and went with 70_sare_uri_eng.cf > > Should v310.pre be removed if v312.pre is also there? > > No, v312.pre contains plugins that were added with SA 3.1.2 and > v310.pre contains plugins added with SA 3.1.0. You should not > remove any of these files. Thanks - that was my guess. :) Josh
