Dear Sirs,
Thanks for your answers.
> Subject: Re: Problems with high spam
> From: guent...@rudersport.de
> To: users@spamassassin.apache.org
> Date: Fri, 18 Sep 2009 21:41:31 +0200
>
> On Fri, 2009-09-18 at 13:51 -0500, Jose Luis Marin Perez wrote:
> > I have the problem that many SPAM emails being filtered to the mail
> > box users, who might that be?
> >
> > These are the statistics from yesterday:
>
> > Although filters 54% of users are reporting much SPAM
>
> About half of the mail in-stream is spam? Yeah, generally that sounds
> like your users will complain. ;) The spam/overall ratio usually is
> *much* higher.
>
>
> > Intel(R) Pentium(R) D CPU 2.80GHz
> > 512 MB Ram
> > 300GB HD
>
> Ouch -- that server could go with some RAM, don't you think? No hard
> numbers, but given your 10k+ messages a day, I guess that's about the
> bare minimum.
>
> Oh, you mentioned yesterday running ClamAV, too. Yes, that is low. Hope
> you don't hit swap yet.
For more than 10000 emails a day how much memory should be the server? as one
can calculate the amount of memory needed?
>
>
> > SpamAssassin 3.2.5 - local.cf
> >
> > ok_locales all
> > skip_rbl_checks 1
>
> You *disabled* DNS BL checks. Enabling them should drastically improve
> results. You'd likely want a local, caching nameserver.
In qmail-smtpd rblsmtpd option is used, is equivalent to DNS BL checks of
SpamAssassin?
>
> > required_hits 3
>
> Not a safe thing to do. That's severely lower than the default. Do
> expect FPs. If you find yourself in the need to lower the threshold that
> drastically, something else is wrong.
Indeed this value was set to 5.0, but there were many SPAM emails so I decided
to lower it to 3.0, which do you recommend?
>
> Also, that option is deprecated (inherited from some ancient conf, I
> assume) and now listens to the name required_score.
It makes a change to required_score 3.0
>
>
> > whitelist_from *...@ideasclaro.com.pe
> > whitelist_from *...@surfcontrol.com
> > whitelist_from *...@inkanatura.com.pe
>
> *Lots* more snipped. If you need that much whitelisting, it indicates
> there is a problem -- in this case, my guess can be seen above. Your
> required_score threshold is too low, and thus you need to whitelist more
> and more legit senders...
This configuration should implement the previous postmaster, if there is the
need to eliminate rest assured that I will.
>
> Even worse, you are using the un-constrained variant. Do NOT do that,
> unless as a last resort. If you need whitelisting at all, do use at
> least the *_rcvd variant, if not the auth'ed ones.
You mean the option whitelist_from_rcvd?
>
> In particular: DO NOT whitelist_from your own domain! If you do, a *lot*
> of spam will sail right through. Spammers love to pretend sending from
> your domain.
>
>
> > header _LOCAL_I_HATE_VIAGRA Subject =~
> > /v.?[i1].?...@].?g.?[\@a]?.?r....@a]/i
> > describe _LOCAL_I_HATE_VIAGRA viagra
> > score _LOCAL_I_HATE_VIAGRA 100.0
>
> Funny. Can't even recall when the last spam like that got through. Do
> you really need such rules?
I did it because many emails arriving with subject or body of the message with
the word VIAGRA
>
> Maybe your Bayes is severely mis-trained? Or maybe you need that to
> counter the whitelist_from for pills spam pretending to be sent from
> your own domain. The score sure hints at that...
>
As if well trained Bayes?
I modify the rule that says "ELLE IS"
I appreciate your answers
Jose Luis
_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live Spaces.
It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us
