I want to share my server configuration for assp running on linux servers. I have several high volume servers running, some that process almost 2 million connections per day with this configuration. I am running v2, however these server wide settings work for v1 as well:
/etc/security/limits.conf assp soft memlock 6400 assp hard memlock 6400 assp soft nofile 130000 assp hard nofile 130000 assp soft stack 1024000 assp hard stack 1024000 assp soft noproc 50000 assp hard noproc 50000 (The above assumes you are running assp as the assp user.) /etc/sysctl.conf net.core.rmem_max = 16777216 net.core.wmem_max = 16777216 net.ipv4.tcp_rmem = 4096 87380 16777216 net.ipv4.tcp_wmem = 4096 65536 16777216 net.ipv4.tcp_no_metrics_save = 1 net.ipv4.tcp_moderate_rcvbuf = 1 net.core.netdev_max_backlog = 2500 For the sysctl settings you can make them take effect by typing 'sysctl -p'. For the other settings I rebooted. Also assp restricts you to 999 connections in assp.pl if you specify 0 for maxSMTPSessions, so I modified assp.pl to change that to: 1999 in two places. I suppose you can enter 1999 in the webUI as well athough I haven't tried that. V2 is pretty stable now for me after I turned off the Bomb Regex stuff. Now it only dies occassionally after several days. I also have it restarting automatically once per day via a cron script. I use monitrc to check if assp is running every 2 minutes and start it if the process has died. Needless to say no pages in the middle of the night anymore! -----Original Message----- From: assp-test-requ...@lists.sourceforge.net [mailto:assp-test-requ...@lists.sourceforge.net] Sent: Tuesday, April 13, 2010 3:42 AM To: assp-test@lists.sourceforge.net Subject: Assp-test Digest, Vol 33, Issue 8 Send Assp-test mailing list submissions to assp-test@lists.sourceforge.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.sourceforge.net/lists/listinfo/assp-test or, via email, send a message with subject or body 'help' to assp-test-requ...@lists.sourceforge.net You can reach the person managing the list at assp-test-ow...@lists.sourceforge.net When replying, please edit your Subject line so it is more specific than "Re: Contents of Assp-test digest..." Today's Topics: 1. Re: SBCache (Thomas Eckardt) 2. delaying filter (suggestion) (Graziano) 3. fixes and changes in assp 2.0.2_1.0.09 (Thomas Eckardt) 4. Re: delaying filter (suggestion) (Thomas Eckardt) ---------------------------------------------------------------------- Message: 1 Date: Sat, 10 Apr 2010 06:51:00 +0200 From: Thomas Eckardt <thomas.ecka...@thockar.com> Subject: Re: [Assp-test] SBCache To: ASSP development mailing list <assp-test@lists.sourceforge.net> Message-ID: <titc.671696fbbe.of52334289.7f4cd55e-onc1257701.001a7193-c1257701.001aa...@t hockar.com> Content-Type: text/plain; charset="us-ascii" >How do things end up in the SBCache table in v2? SBCache caches the information in which country the IP is registered and for which company and domain it is registered. Thomas Von: "Masood Rahim" <mas...@intertune.com> An: <assp-test@lists.sourceforge.net> Datum: 09.04.2010 21:28 Betreff: Re: [Assp-test] SBCache How do things end up in the SBCache table in v2? I guess I'm trying to find out what this table is for. Thanks, Masood -----Original Message----- From: assp-test-requ...@lists.sourceforge.net [mailto:assp-test-requ...@lists.sourceforge.net] Sent: Friday, April 09, 2010 9:15 AM To: assp-test@lists.sourceforge.net Subject: Assp-test Digest, Vol 33, Issue 6 Send Assp-test mailing list submissions to assp-test@lists.sourceforge.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.sourceforge.net/lists/listinfo/assp-test or, via email, send a message with subject or body 'help' to assp-test-requ...@lists.sourceforge.net You can reach the person managing the list at assp-test-ow...@lists.sourceforge.net When replying, please edit your Subject line so it is more specific than "Re: Contents of Assp-test digest..." Today's Topics: 1. Re: Assp 2.0.1(1.0.06) download failed (GrayHat) 2. Bombre (Hill, Brett) 3. Re: Bombre (Hill, Brett) 4. Re: Bombre (Fritz Borgstedt) 5. Re: Bombre (Hill, Brett) 6. Re: Bombre (Thomas Eckardt) 7. Re: Bombre (Hill, Brett) 8. Re: Bombre (Fritz Borgstedt) ---------------------------------------------------------------------- Message: 1 Date: Fri, 9 Apr 2010 11:48:20 +0200 From: "GrayHat" <gray...@gmx.net> Subject: Re: [Assp-test] Assp 2.0.1(1.0.06) download failed To: "ASSP development mailing list" <assp-test@lists.sourceforge.net> Message-ID: <006801cad7c9$ca0f2930$1400a...@apra.it> Content-Type: text/plain; charset="utf-8" > Assp can?t download the newe version on Wiki. > The last update on Wiki for Version 2 was on 22.03.2010 I have seen a > new Version 2.0.1(1.0.08) this was on the mailinglist Pick the latest version here http://assp.cvs.sourceforge.net/viewvc/assp/assp2/ notice that the above version is different from the ones published on SF since it uses the above CVS server to fetch the latest updates; also notice that such version may be considered an "unstable" one (although in my experience it's usually quite stable :D) Bottom line; if you want to go for "stable", pick the version from SF, if otherwise you want to follow the latest updates and use the beta, pick the above version ------------------------------ Message: 2 Date: Fri, 9 Apr 2010 09:04:28 -0400 From: "Hill, Brett" <hil...@nlbusa.com> Subject: [Assp-test] Bombre To: "ASSP development mailing list" <assp-test@lists.sourceforge.net> Message-ID: <sig.0715831f40.15ee2aaa8d90cf449983494481233cfc05271...@nlbexc.nlbusa.com> Content-Type: text/plain; charset="us-ascii" How would you write a bombre regex to catch the following: filename="UPS_invoice_2794.zip" I've tried: filename="UPS_invoice_{1,4}.zip" and variants with greater numbers like {1,10} However, the ASSP analyzer doesn't pick it up. Also, the following statement creates a huge error in the ASSP Log (essentially the whole bombre.txt file is in there): (?si)the.branch.manager.{1,10}of.the.Eco.Bank.Of.Ghana.Limited The end of the log entry says: (?{length($1)>32?substr($1,0,32-3).'...':$1})/ at c:\assp\assp.pl line 6761.; Any advice would be most welcome! Kind Regards, Brett ------------------------------ Message: 3 Date: Fri, 9 Apr 2010 09:08:07 -0400 From: "Hill, Brett" <hil...@nlbusa.com> Subject: Re: [Assp-test] Bombre To: "ASSP development mailing list" <assp-test@lists.sourceforge.net> Message-ID: <sig.171514aa9e.15ee2aaa8d90cf449983494481233cfc05271...@nlbexc.nlbusa.com> Content-Type: text/plain; charset="us-ascii" Sorry, There's supposed to be a "\" before the period. I forgot to add it when typing, but it's in the regex with a \. Brett Hill, Brett wrote: > Sent: Friday, April 09, 2010 9:04 AM > To: ASSP development mailing list > Subject: [Assp-test] Bombre > > How would you write a bombre regex to catch the following: > filename="UPS_invoice_2794.zip" > > I've tried: filename="UPS_invoice_{1,4}\.zip" and variants > with greater > numbers like {1,10} > However, the ASSP analyzer doesn't pick it up. ------------------------------ Message: 4 Date: Fri, 09 Apr 2010 15:13:15 +0200 From: "Fritz Borgstedt" <f...@iworld.de> Subject: Re: [Assp-test] Bombre To: "ASSP development mailing list" <assp-test@lists.sourceforge.net> Message-ID: <sig.07159fe33b.fc.000f455506e43a8e3b9aca008ea46836.6e43...@iworld.de> Content-Type: text/plain; charset=ISO-8859-1 ASSP development mailing list <assp-test@lists.sourceforge.net> schreibt: >I've tried: filename="UPS_invoice_{1,4}.zip" and variants with >greater UPS_invoice_.{1,4}.zip ------------------------------ Message: 5 Date: Fri, 9 Apr 2010 09:38:59 -0400 From: "Hill, Brett" <hil...@nlbusa.com> Subject: Re: [Assp-test] Bombre To: "ASSP development mailing list" <assp-test@lists.sourceforge.net> Message-ID: <sig.0715e155d7.15ee2aaa8d90cf449983494481233cfc05271...@nlbexc.nlbusa.com> Content-Type: text/plain; charset="us-ascii" Thanks! > -----Original Message----- > From: Fritz Borgstedt [mailto:f...@iworld.de] > Sent: Friday, April 09, 2010 9:13 AM > To: ASSP development mailing list > Subject: Re: [Assp-test] Bombre > > ASSP development mailing list <assp-test@lists.sourceforge.net> > schreibt: > >I've tried: filename="UPS_invoice_{1,4}.zip" and variants with > >greater > > UPS_invoice_.{1,4}.zip ------------------------------ Message: 6 Date: Fri, 9 Apr 2010 16:01:40 +0200 From: Thomas Eckardt <thomas.ecka...@thockar.com> Subject: Re: [Assp-test] Bombre To: ASSP development mailing list <assp-test@lists.sourceforge.net> Message-ID: <titc.37158a5f03.of3db9c24f.d1b58816-onc1257700.00496bb6-c1257700.004d0...@t hockar.com> Content-Type: text/plain; charset="us-ascii" any of this should do it: UPS_invoice_\d{1,4}\.zip # 1 - 4 digits UPS_invoice_\d*\.zip # 0 - infinity digits UPS_invoice_\d+\.zip # 1 - infinity digits UPS_invoice_.*?\.zip # 0 - infinity characters UPS_invoice_.+?\.zip # 1 - infinity characters >(?si)the.branch.manager.{1,10}of.the.Eco.Bank.Of.Ghana.Limited the (?si) is not needed, because assp is doing it already that way, use instead the\s+branch\s+manager.+?Ghana\s+Limited keep in mind, that results of a regex, that are are longer than 32 characters, will not work in a weighted regex: for example, assume that the regex definition of: the\s+branch\s+manager.+?Ghana\s+Limited=>2.5 will return the result: the branch manager Brett Hill of the Eco Bank of Ghana Limited This result will be trunked and changed to: the branch manager Brett Hill ... by the statement : (?{length($1)>32?substr($1,0,32-3).'...':$1}) Because of this change, the search in the registered weights (weighted regexes), which is a post search on the resulting string, will never match - and the default PB value will be used. This was changed by me in 2.0.2 1.0.08 - but I think Fritz has not jet changed it in V1? Thomas Von: "Hill, Brett" <hil...@nlbusa.com> An: "ASSP development mailing list" <assp-test@lists.sourceforge.net> Datum: 09.04.2010 15:05 Betreff: [Assp-test] Bombre How would you write a bombre regex to catch the following: filename="UPS_invoice_2794.zip" I've tried: filename="UPS_invoice_{1,4}.zip" and variants with greater numbers like {1,10} However, the ASSP analyzer doesn't pick it up. Also, the following statement creates a huge error in the ASSP Log (essentially the whole bombre.txt file is in there): (?si)the.branch.manager.{1,10}of.the.Eco.Bank.Of.Ghana.Limited The end of the log entry says: (?{length($1)>32?substr($1,0,32-3).'...':$1})/ at c:\assp\assp.pl line 6761.; Any advice would be most welcome! Kind Regards, Brett ---------------------------------------------------------------------------- -- Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* ------------------------------ Message: 7 Date: Fri, 9 Apr 2010 10:44:45 -0400 From: "Hill, Brett" <hil...@nlbusa.com> Subject: Re: [Assp-test] Bombre To: "ASSP development mailing list" <assp-test@lists.sourceforge.net> Message-ID: <sig.0715b88724.15ee2aaa8d90cf449983494481233cfc05271...@nlbexc.nlbusa.com> Content-Type: text/plain; charset="us-ascii" Thomas Eckardt wrote: > any of this should do it: > > UPS_invoice_\d{1,4}\.zip # 1 - 4 digits > UPS_invoice_\d*\.zip # 0 - infinity digits > UPS_invoice_\d+\.zip # 1 - infinity digits > UPS_invoice_.*?\.zip # 0 - infinity characters > UPS_invoice_.+?\.zip # 1 - infinity characters Thank you for explaining more in detail. Unfortunately, none of those work in ASSP 1.7.x. I forgot to mention in my original post that I was using the 1.7.x version. > >(?si)the.branch.manager.{1,10}of.the.Eco.Bank.Of.Ghana.Limited > > the (?si) is not needed, because assp is doing it already > that way, use instead It was recommended by Fritz some months ago when I asked about it. I guess something changed in between 1.7.1.4(0.0.04) and (0.0.07). Or at least I didn't notice the error before that. What led me to the error was that the maillog tail was only showing 5 or 6 lines and then added a new line each time I refreshed it. It was the oddest thing. > the\s+branch\s+manager.+?Ghana\s+Limited > > keep in mind, that results of a regex, that are are longer > than 32 characters, will not work in a weighted regex: > > for example, assume that the regex definition of: > the\s+branch\s+manager.+?Ghana\s+Limited=>2.5 > > will return the result: > the branch manager Brett Hill of the Eco Bank of Ghana Limited > > This result will be trunked and changed to: > the branch manager Brett Hill ... > > by the statement : (?{length($1)>32?substr($1,0,32-3).'...':$1}) > Because of this change, the search in the registered weights > (weighted regexes), which is a post search on the resulting > string, will never match > - and the default PB value will be used. > > This was changed by me in 2.0.2 1.0.08 - but I think Fritz > has not jet changed it in V1? Something changed! :-) I wasn't doing a weighted regex as it usually only shows up once in an email, but I think the 32 character limit has been there for some time (in some form or fashion). Emails with that wording don't come through much anymore. I'll just comment it out for now and see if I get anymore. Thanks for your assistance! Brett ------------------------------ Message: 8 Date: Fri, 09 Apr 2010 18:14:49 +0200 From: "Fritz Borgstedt" <f...@iworld.de> Subject: Re: [Assp-test] Bombre To: "ASSP development mailing list" <assp-test@lists.sourceforge.net> Message-ID: <sig.171536acd0.fc.000f455506e445753b9aca008ea46836.6e44...@iworld.de> Content-Type: text/plain; charset=ISO-8859-1 ASSP development mailing list <assp-test@lists.sourceforge.net> schreibt: >Thank you for explaining more in detail. Unfortunately, none of those >work in ASSP 1.7.x. I forgot to mention in my original post that I >was >using the 1.7.x version. There is no difference between V1 and V2 in the Regex-Matching. ------------------------------ ---------------------------------------------------------------------------- -- Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev ------------------------------ _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test End of Assp-test Digest, Vol 33, Issue 6 **************************************** ---------------------------------------------------------------------------- -- Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* ------------------------------ Message: 2 Date: Tue, 13 Apr 2010 12:29:39 +0200 From: Graziano <dreamserv...@libero.it> Subject: [Assp-test] delaying filter (suggestion) To: ASSP development mailing list <assp-test@lists.sourceforge.net> Message-ID: <4bc44793.6070...@libero.it> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hello could it possible have an option to apply all ASSP spam checks if a sender passes successfully delaying/greylisting ? Graziano ------------------------------ Message: 3 Date: Tue, 13 Apr 2010 12:35:19 +0200 From: Thomas Eckardt <thomas.ecka...@thockar.com> Subject: [Assp-test] fixes and changes in assp 2.0.2_1.0.09 To: ASSP development mailing list <assp-test@lists.sourceforge.net> Message-ID: <titc.2719458d55.ofc72971a3.b83bcb31-onc1257704.0035ada0-c1257704.003a2...@t hockar.com> Content-Type: text/plain; charset="us-ascii" Hi all, fixed in 2.0.2_1.0.09 - If an regular expression has failed to compile (in 1.0.08), the contents of the regex was written in to the file assp.cfg. changed: - if VRFY or RCPT TO is used to verify the recipient address and the MTA is not available the address was rejected - it is now accepted in this case - the usage of the precompiled regular expressions is improved by a major code change added: - There are two new modules available at SF-CVS ./lib/Regex/List.pm ./lib/Regex/Optimize.pm download both files and place them in to same directory (case sensitive and downlevel to the assp folder) on your system If both modules are installed and 'Regex::Optimize' is enabled in the 'Module Setup' section of the GUI, ASSP tries to optimize all regular expressions. The optimized versions are exported to the ./files/optRE folder. The optimized regexes are running faster and needs less memory! If any regex fails to optimize, the default regex will be used. Because of the optimization of the regexes, ASSP will need significant more time at startup! Thomas DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* ------------------------------ Message: 4 Date: Tue, 13 Apr 2010 12:41:29 +0200 From: Thomas Eckardt <thomas.ecka...@thockar.com> Subject: Re: [Assp-test] delaying filter (suggestion) To: ASSP development mailing list <assp-test@lists.sourceforge.net> Message-ID: <titc.47194c5c4d.off263179b.8dfbf456-onc1257704.003a5178-c1257704.003ab...@t hockar.com> Content-Type: text/plain; charset="us-ascii" >could it possible have an option to apply all ASSP spam checks if a >sender passes >successfully delaying/greylisting ? I think this does not make sense. Running checks, that are not configured will result in a unwanted behavior of assp. But if all features are well configured, all checks will be used by assp. Thomas Von: Graziano <dreamserv...@libero.it> An: ASSP development mailing list <assp-test@lists.sourceforge.net> Datum: 13.04.2010 12:30 Betreff: [Assp-test] delaying filter (suggestion) Hello could it possible have an option to apply all ASSP spam checks if a sender passes successfully delaying/greylisting ? Graziano ---------------------------------------------------------------------------- -- Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* ------------------------------ ---------------------------------------------------------------------------- -- Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev ------------------------------ _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test End of Assp-test Digest, Vol 33, Issue 8 **************************************** ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
