On Montag, 17. Oktober 2005 16:52 Spam Admin wrote: > So, to temporarily resolve this, I bumped our kill_level to 5.9 and > am monitoring it; my false positives have pretty much disappeared. Of > course, I've seen a *slight* increase in fasle negatives versus 2.63, > so I'll be tuning.
I use 5.0 (the default) on several servers, with very good results. Almost no FP, almost no SPAM. There are a lot of RBL lists used on the SMTP layer already, taking much work from SA. Example: From 58k connects we denied 36k via RBL. 8620 messages arrived finally, from which 244 were marked as SPAM, 30 viruses. > Our > amount of spam has increased DRAMATICALLY over the last 2-3 weeks, > plus the processing times within the box are going skyward (even on > the secondary box still running v2.63), so any advice is sincerely > appreciated. Do you believe this has to do with the upgrade? Or are there just more messages arriving now? If you have postfix, use sender_blacklist from William Stearns ( http://www.sa-blacklist.stearns.org/sa-blacklist ), RBL hosts recommended by me are sbl-xbl.spamhaus.org, safe.dnsbl.sorbs.net, dnsbl.njabl.org, bl.spamcop.net, relays.ordb.org. Everything you throw away at SMTP level doesn't need to be checked by SA. mfg zmi -- // Michael Monnerie, Ing.BSc --- it-management Michael Monnerie // http://zmi.at Tel: 0660/4156531 Linux 2.6.11 // PGP Key: "lynx -source http://zmi.at/zmi2.asc | gpg --import" // Fingerprint: EB93 ED8A 1DCD BB6C F952 F7F4 3911 B933 7054 5879 // Keyserver: www.keyserver.net Key-ID: 0x70545879
pgprvqeWFevKi.pgp
Description: PGP signature
