Re: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Pete McNeil 
On Monday, March 21, 2005, 11:00:49 AM, Chase wrote:

snip/

CS   Looking at our test list (posted bellow), we likely have WAY too
CS many dns blacklists. That will be the first thing I look at. Any
CS other suggestions?

I have had luck running a DNS server (resolver - bind) locally on the
IMail box using the loopback address for the primary DNS (127.0.0.1)
to speed things up. YMMV

Also, take a look at this data to see which tests are performing best
and perhaps weed out some of the others:

http://www.sortmonster.com/MDLP/MDLP-Example-Long.html

Hope this helps,

_M



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Pete McNeil 
On Monday, March 21, 2005, 11:00:49 AM, Chase wrote:

CS I need some help tuning Declude for performance. Up until

One other thought (pushed send too fast).

You may have a test or two in there that is not responding --- causing
things to time out and slow things down. If you can find it and drop
it things should speed up quite a bit.

_M



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Chase Seibert 

I don' have UCEPROTECRDO, XBL-DYNA, BLKLST-SURBL andHELOISIP. Can you post your definitions for those? Can I get them off the declude website somehow (I couldn't find them)?


 -Chase
Chase Seibert| Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com

-Original Message-From:Pete McNeil [EMAIL PROTECTED] To: "Chase Seibert" ;Sent: Mar 21, 2005 11:16:28 AMSubject: Re: [Declude.JunkMail] Declude performance questionOn Monday, March 21, 2005, 11:00:49 AM, Chase wrote: CS Looking at our test list (posted bellow), we likely have WAY too CS many dns blacklists. That will be the first thing I look at. Any CS other suggestions? I have had luck running a DNS server (resolver - bind) locally on the IMail box using the loopback address for the primary DNS (127.0.0.1) to speed things up. YMMV Also, take a look at this data to see which tests are performing best and perhaps weed out some of the others: http://www.sortmonster.com/MDLP/MDLP-Example-Long.html Hope this helps, _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Chase Seibert 

Any recommendations for Declude add-ins or log readers that might be able to detect the run times of various tests? If I set logging to high would it log runtimes?


 -Chase
Chase Seibert| Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com

-Original Message-From:Pete McNeil [EMAIL PROTECTED] To: "Chase Seibert" ;Sent: Mar 21, 2005 11:28:50 AMSubject: Re: [Declude.JunkMail] Declude performance questionOn Monday, March 21, 2005, 11:00:49 AM, Chase wrote: CS I need some help tuning Declude for performance. Up until One other thought (pushed send too fast). You may have a test or two in there that is not responding --- causing things to time out and slow things down. If you can find it and drop it things should speed up quite a bit. _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Scott Fisher 



The test definitions might be more helpful than the 
Test actions...

I see AHBL is listed twice.
DSbl is listed twice.Sorbs is listed as are 
many of the SORBS individual tests. Possible overlap.
You list CBL/Blitzedall/SBL and Spamhaus listed. 
Potential overlap here.
Reynolds is a now pay service I believe. If you 
aren't paying maybe that is an issue.

  - Original Message - 
  From: 
  Chase Seibert 
  
  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, March 21, 2005 10:00 
  AM
  Subject: [Declude.JunkMail] Declude 
  performance question
  
  
  I 
  need some help tuning Declude for performance. Up until now, I have been 
  adding tests mainly for spam filtering effectiveness. But I notice now that 
  the server can process about7 messages per second with the spam 
  filtering off, versus only about 1-1.5 messages per second with Declude turned 
  on.I suspect the delays are mostly network IO bound; the processors and 
  ram on the boxes are relatively idle. When Declude is disabled, the CPU is 
  pinned between iMail and come custom database insertion services we have. We 
  do about 200,000 inbound messages a day between two servers, so the speed 
  issue really only comes up when mail has queued up for some reason and needs 
  to be de-queued.
  
  Looking 
  at our test list (posted bellow), we likely have WAY too many dns blacklists. 
  That will be the first thing I look at. Any other suggestions? 
  
  I 
  don't think it's any one test, but this is what we have turned on:
  
  AHBLWARNBLITZEDALLWARNCBLWARNDSBLWARNORDBWARNSBLWARNSORBS-HTTPWARNSORBS-SOCKSWARNSORBS-MISCWARNSORBS-SMTPWARNSORBS-SPAMWARNSORBS-WEBWARNSORBS-BLOCKWARNSORBS-ZOMBIEWARNSORBS-DUHLWARNSPAMCOPWARN
  
  DSNWARNNOABUSEWARNNOPOSTMASTERWARN
  BADHEADERSWARNBASE64WARNCMDSPACEWARNCOMMENTSWARNHELOBOGUSWARNIPNOTINMXIGNOREMAILFROM 
  WARNNOLEGITCONTENTIGNOREPERCENTWARNREVDNSWARNROUTINGWARNSPAMHEADERSWARN
  FIVETENSRCWARNspamhausWARNdsblWARNnjablWARNreynoldsWARNOridWARNJammWARNAHBLWARNsorbsWARNdnsbl-1WARNdnsbl-2WARNsurrielWARN
  SNIFFERWARNINV-URIBLWARN
  IMAILSTAT 
  WARN
  
  
   
  -Chase
  Chase 
  Seibert| Network and Systems Engineer 
  | Bullhorn Inc. | 617.464.2440 x119 
  | www.bullhorn.com

RE: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Chase Seibert 

Turned out to be that one of our two DNS servers was down; causing a timeout on many of the requests. That's fixed, and Declude is now performing at about 3-4 messages per second. Much better, and not that far off the throughput with zero spam filtering.


 -Chase
Chase Seibert| Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com

-Original Message-From: [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" <DECLUDE.JUNKMAIL@DECLUDE.COM>;Sent: Mar 21, 2005 11:32:33 AMSubject: RE: [Declude.JunkMail] Declude performance question

Any recommendations for Declude add-ins or log readers that might be able to detect the run times of various tests? If I set logging to high would it log runtimes?


 -Chase
Chase Seibert| Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com

-Original Message-From:Pete McNeil [EMAIL PROTECTED] To: "Chase Seibert" <DECLUDE.JUNKMAIL@DECLUDE.COM>;Sent: Mar 21, 2005 11:28:50 AMSubject: Re: [Declude.JunkMail] Declude performance questionOn Monday, March 21, 2005, 11:00:49 AM, Chase wrote: CS I need some help tuning Declude for performance. Up until One other thought (pushed send too fast). You may have a test or two in there that is not responding --- causing things to time out and slow things down. If you can find it and drop it things should speed up quite a bit. _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Scott Fisher 



XBL is = CBL  Blitzed all
UCE is probably your dnsbl-1 
dnsbl-2

HELOISIP is an external test to see if the HELo is 
an IP address.
Seehttp://www.mail-archive.com/declude.junkmail@declude.com/msg17819.html

Blklst-surbl might be duplicating the 
invuribl test you are running.

- Original Message - 

  From: 
  Chase Seibert 
  
  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, March 21, 2005 10:29 
  AM
  Subject: RE: [Declude.JunkMail] Declude 
  performance question
  
  
  I 
  don' have UCEPROTECRDO, XBL-DYNA, BLKLST-SURBL andHELOISIP. Can you post 
  your definitions for those? Can I get them off the declude website somehow (I 
  couldn't find them)?
  
  
   
  -Chase
  Chase 
  Seibert| Network and Systems Engineer 
  | Bullhorn Inc | 617.464.2440 x119 
  | www.bullhorn.com
  
  -Original 
  Message-From:Pete McNeil [EMAIL PROTECTED] 
  To: "Chase Seibert" <DECLUDE.JUNKMAIL@DECLUDE.COM>;Sent: 
  Mar 21, 2005 11:16:28 AMSubject: Re: [Declude.JunkMail] Declude 
  performance questionOn Monday, March 21, 2005, 11:00:49 AM, Chase 
  wrote: CS Looking at our test list (posted 
  bellow), we likely have WAY too CS many dns blacklists. That will be 
  the first thing I look at. Any CS other suggestions? I have 
  had luck running a DNS server (resolver - bind) locally on the IMail box 
  using the loopback address for the primary DNS (127.0.0.1) to speed things 
  up. YMMV Also, take a look at this data to see which tests are 
  performing best and perhaps weed out some of the others: 
  http://www.sortmonster.com/MDLP/MDLP-Example-Long.html Hope 
  this helps, _M --- This E-mail came from the 
  Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to 
  [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The 
  archives can be found at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Scott Fisher 



Test runtimes aren't listed in logging level 
HIGH.
They might be in debug mode, but I wouldn't run 
that for long.

  - Original Message - 
  From: 
  Chase Seibert 
  
  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, March 21, 2005 10:30 
  AM
  Subject: RE: [Declude.JunkMail] Declude 
  performance question
  
  
  Any 
  recommendations for Declude add-ins or log readers that might be able to 
  detect the run times of various tests? If I set logging to high would it log 
  runtimes?
  
  
   
  -Chase
  Chase 
  Seibert| Network and Systems Engineer 
  | Bullhorn Inc. | 617.464.2440 x119 
  | www.bullhorn.com
  
  -Original 
  Message-From:Pete McNeil [EMAIL PROTECTED] 
  To: "Chase Seibert" <DECLUDE.JUNKMAIL@DECLUDE.COM>;Sent: 
  Mar 21, 2005 11:28:50 AMSubject: Re: [Declude.JunkMail] Declude 
  performance questionOn Monday, March 21, 2005, 11:00:49 AM, Chase 
  wrote: CS I need some help tuning Declude for performance. Up 
  until One other thought (pushed send too fast). You may have a 
  test or two in there that is not responding --- causing things to time out 
  and slow things down. If you can find it and drop it things should speed 
  up quite a bit. _M --- This E-mail came from the 
  Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to 
  [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The 
  archives can be found at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude performance question

2005-03-21 Thread John Tolmachoff \(Lists\) 








Here is an idea many of us use:



Configure DNS service on the Imail
server for caching only. 



Point Imail/Declude to use the DNS on
the same server.



Configure the DNS service to use your
other DNS servers and forwarders.



You will see a slight performance boost.





John Tolmachoff

Engineer/Consultant/Owner

eServices For You







-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chase Seibert
Sent: Monday, March
 21, 2005 8:46 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail]
Declude performance question







Turned out to be that
one of our two DNS servers was down; causing a timeout on many of the requests.
That's fixed, and Declude is now performing at about 3-4 messages per second.
Much better, and not that far off the throughput with zero spam filtering.
















-Chase



Chase Seibert| Network
and Systems Engineer | Bullhorn
Inc | 617.464.2440 x119 | www.bullhorn.com

















-Original Message-
From: [EMAIL PROTECTED] 
To:
Declude.JunkMail@declude.com <DECLUDE.JUNKMAIL@DECLUDE.COM>;
Sent: Mar 21, 2005 11:32:33 AM
Subject: RE: [Declude.JunkMail]
Declude performance question









Any recommendations
for Declude add-ins or log readers that might be able to detect the run times
of various tests? If I set logging to high would it log runtimes?

















-Chase



Chase Seibert| Network
and Systems Engineer | Bullhorn
Inc | 617.464.2440 x119 | www.bullhorn.com















-Original Message-
From:Pete McNeil
[EMAIL PROTECTED] 
To: Chase Seibert <DECLUDE.JUNKMAIL@DECLUDE.COM>;
Sent: Mar 21, 2005 11:28:50 AM
Subject: Re: [Declude.JunkMail]
Declude performance question




On Monday, March 21, 2005, 11:00:49 AM, Chase
wrote: 

CS I need some help tuning Declude for performance. Up until 

One other thought (pushed send too fast). 

You may have a test or two in there that is not responding --- causing 
things to time out and slow things down. If you can find it and drop 
it things should speed up quite a bit. 

_M 



--- 
This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
type unsubscribe Declude.JunkMail. The archives can be found 
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude performance question

2005-03-21 Thread Bud Durland 
Chase Seibert wrote:
I don' have UCEPROTECRDO, XBL-DYNA, BLKLST-SURBL and HELOISIP. Can you 
post your definitions for those? Can I get them off the declude 
website somehow (I couldn't find them)?

I wrote the HELOISIP test.  It's not a DNS test.  Rather, it will tell 
you if the HELO or REVDNS of the incoming message has an embedded IP 
address.  While not 100%, this is often an indicator of a spam message 
from a dynamic IP address.  You can download it from 
http://bud.thedurlands.com

Hope this helps
--

I don't need anger management; I need people to stop making me angry

Bud Durland, CNE  Mold-Rite Plastics
Network Administrator  http://www.mrpcap.com

---
[This E-mail scanned for viruses by Declude Virus / Sophos AV]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.