From: Keith De Souza <kbdeso...@googlemail.com>
Date: Wed, 31 Mar 2010 14:10:50 +0100
Hi
*>> You need to change whatever glue you are using to pass messages to SA,
>>and skip the scanning for messages larger than your desired threshold.
*Sorry as I'm new to SA can you elaborated what you mean by glue?
*
>>That said, IMHO 100k is rather low. Why do you want that particular
>>threshold?*
Judging from your response, I may be wrong in what I need to do:
Basically I'm having a few errors in my Exim logs from legitamate senders
not coming through:
300 seconds looks like an timeout. Something is giving up after
waiting 300 seconds.
Note the autolearn=unavailable. I'd guess that you are getting
locked out from the Bayes database. You probably had a Bayes expire
running at the same time. There should be messages about this in a
log file.
If this is the case you can turn off bayes_auto_expire and run expire
from cron. You could also try learning to the journal and doing
sa-learn --sync periodically from cron.
-jeff
===========
2010-03-31 01:22:25 1Nwlbc-0001QS-Ua H=
host81-136-197-86.in-addr.btopenworld.com (mail.duke.tv) [81.136.197.86] F=<
l...@dukeandearl.com> temporarily rejected after DATA
===========
And after checking my SA logs:
===========
Mar 31 01:25:51 mailserver spamd[5379]: spamd: result: . -4 -
GENESIS_PHONENUMBER07 *scantime=300.0,size=24337*,
user=nobody,uid=8,required_score=3.2,rhost=localhost,raddr=127.0.0.1,rport=42308,mid=<
c7d27527.8a78%l...@dukeandearl.com <c7d27527.8a78%25l...@dukeandearl.com>
>,autolearn=unavailable
==========
I'm trying to understand why is it taking 300.0 seconds to scan a message
only 24Kb in size??
I'm begeining to think that because SA is taking so long to scan the
message, it is timing out
and hence Exim returning a "temporarily reject after DATA".
My thoughs so far is to perhaps reducing the file size that SA takes to scan
and see if the scan time reduces.
I may be wrong in my troublshooting methods but I'm not sure why this is
happeninig at present.
Many Thanks
2010/3/31 Karsten Bräckelmann <guent...@rudersport.de>
> On Wed, 2010-03-31 at 13:24 +0100, Keith De Souza wrote:
> > My current sysadmin has now left the company and I'm new to SA and
> > Exim. [...]
>
> > I've read somewhere that the default setting for SA to scan a message
> > is 500k.
>
> That's actually the default for spamc. Messages exceeding the threshold
> just won't be passed to spamd. SA (and spamd) will check everything it
> gets passed.
>
> > Can I reduce this, so that SA scans messages 100k and below?
>
> You need to change whatever glue you are using to pass messages to SA,
> and skip the scanning for messages larger than your desired threshold.
>
> That said, IMHO 100k is rather low. Why do you want that particular
> threshold?
>
> guenther
>
>
> --
> char *t="\10pse\0r\0dtu...@ghno
> \x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
> main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8?
> c<<=1:
> (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0;
> }}}
>
>
