Hi Scott- My body filter runs last. It's set now to skip messages with attachments (Thanks, Rick Davidson for that one!). SKIPIFWEIGHT is just above my delete weight.
I tried to derive from the daily report and WAMLOG how many times the filter runs, and my best guess is that it runs for around 25% of the messages. It would be nice to know if that is even close. Sounds like it might be if SKIPIFWEIGHT drops 80% of yours before the filter runs. -d ----- Original Message ----- From: "Scott Fisher" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, June 17, 2004 1:19 PM Subject: Re: [Declude.JunkMail] Declude and attachments I haven't found any easy way to tell. The information is in the logs at high level. But I can chime in that SKIPIFWEIGHT bypasses about 80% of my e-mail that is obviously spam. TESTSFAILED ENDS for "friendly domains/revdns" drop off about 8% of e-mail that is most likely not spam, leaving about 12% of the e-mail that I run body filters on. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 06/17/04 12:03PM >>> Matt- My body filters only catch about 4% of messages, but I don't know how often they are run. Is htere a convenient way to tell? -d ----- Original Message ----- From: "Matt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, June 17, 2004 12:40 PM Subject: Re: [Declude.JunkMail] Declude and attachments > Scott, > > I've got a lot more BODY filters than Dave has, though I don't feel that > they are excessive. I probably have about 1,500 BODY searches, but with > SKIPIFWEIGHT they only run about 25% of the time. > > If Dave is using Declude Virus, I would also look there for the issue. > Anything besides F-Prot and ClamAV in daemon mode will chug a server on > a large attachment and it will use up far more processing than Declude > JunkMail, but it will keep the Declude instance alive for longer. On > about 65,000 messages a day currently, we generally see from 2 to 10 > Declude processes running at one time with both F-Prot and AVG enabled > (much less with just F-Prot). Disabling AVG results in our average > processor utilization dropping by 1/3 to 1/2 on heavy load hours. > > Matt > > > > R. Scott Perry wrote: > > > > >> One instance of Declude, then two, then three, all in the 25%+ range. As > >> soon as it dropped to two Decludes, Queue Manager came right in at > >> 30-40%, > >> then the cycles dropped as QueueManager dropped down. > > > > > > It does sound like it is the large files that are causing the problem. > > > > One option would be to temporarily disable the BODY filter with the > > 200 lines in it, to see if that prevents the problem with the high CPU > > usage in Declude JunkMail. That could indeed be causing the problem. > > > > The other would be to use the debug mode ("LOGLEVEL DEBUG" in the > > \IMail\Declude\global.cfg file) and waiting for one of these files to > > be sent. We can look at the debug log file entries to get a better > > idea of where the high CPU usage is occurring. > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail > > mailservers since 2000. > > Declude Virus: Ultra reliable virus detection and the leader in > > mailserver vulnerability detection. > > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > -- > ===================================================== > MailPure custom filters for Declude JunkMail Pro. > http://www.mailpure.com/software/ > ===================================================== > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.