Ian Eiloart wrote: > Please keep the conversation on the list. I've partially obfuscated the > email addresses in your log extract. > > --On 19 May 2009 15:20:23 -0500 [email protected] wrote: > >> Guess new server is not going to help: >> [r...@mx0 ~]# grep 1M6Vfd-0000VR-Vl /var/log/exim/main.log >> 2009-05-19 15:13:16 1M6Vfd-0000VR-Vl <= >> [email protected] >> H=ccm32.constantcontact.com [208.75.123.228] P=esmtp S=29124 >> id=1102585670301.1102184301057.xxxx.7.24161...@scheduler >> 2009-05-19 15:13:17 1M6Vfd-0000VR-Vl => [email protected] R=internal >> T=remote_smtp H=mail.katy.com [216.86.147.164] X=TLSv1:AES256-SHA:256 >> 2009-05-19 15:13:17 1M6Vfd-0000VR-Vl Completed >> [r...@mx0 ~]# >> >> We are processing in under a minute. > > This log entry doesn't prove that. The first line was logged when you > accepted the message. The question is, what was the period from their > making a connection to that point. To get that, you need to make your > logging more verbose. Check the documentation for log_selector (section > 49.15 Reducing or increasing what is logged). > > You probably want to add some of these: smtp_connection > smtp_incomplete_transaction smtp_no_mail smtp_protocol_error > smtp_syntax_error ident_timeout >
Unless 'partially obfuscated' changed more than I think it did, roughly one-second processing is within reach on that one, as it is a known spam engine: 2009-05-17 14:56:56 [13605] SMTP connection from [63.251.135.75]:8750 I=[203.194.153.81]:25 (TCP/IP connection count = 1) 2009-05-17 14:56:57 [50526] H=ccm00.constantcontact.com [63.251.135.75]:8750 I=[203.194.153.81]:25 rejected connection in "connect" ACL: C9 ccm00.constantcontact.com Locally blacklisted. The match was on: *.constantcontact.com Which raises the question - how much of the problem the OP reports is driven by a server spending more time than it needs to anal-izing spam that could have been rejected early on smell alone? Bill > > >> I am not sure best way to get a reliable mean, median, mode >> >> eximstats ---help >> >> >> Ian Eiloart wrote: >>> >>> --On 18 May 2009 12:32:30 -0500 [email protected] wrote: >>> >>>> It does seem like we are going to need to beef up the Exim hardware and >>>> perhaps go to local RBL. >>> Really? Check your logs to see if you can work out how long you're >>> taking to return OK. If it's less than five minutes, then this (a) isn't >>> your problem, and (b) is probably defending you from quite a lot of spam. >>> >>>> [email protected] wrote: >>>>>> From: schmero...@gmail >>>>>> We are getting duplicate emails. It seems to be the same senders, >>>>>> however not every one of their emails duplicate. 5% of mails from >>>>>> Charter.net will duplicate, 10% of mails from Cox will duplicate, 100% >>>>>> of mails from Interfax.net will duplicate. >>>>>> spamd_address = 127.0.0.1 783 >>>>> I guess that your spam-filter queries some RBL, and one or more of them >>>>> timeout because dead or for paying customers only. >>>>> Try switch spam-filtering via spamd off temporarily. >>>>> If that doesn't help then try to switch virus-filtering off >>>>> temporarily. >>> >>> > > > -- ## List details at http://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
