Jdow wrote: >Steve, it might help if you listed which rule sets. There are some >which are obscenely large and others that are obsolete. Maybe we >can prune the list for you a little.
As some have mentioned I may have too many rules. I would like to know what is a must have and what I should not use. Here is a list of what is currently in the /etc/mail/spamassassin/ folder: CURRENTLY IN /ETC/MAIL/SPAMASSASSIN 70_sare_adult.cf 70_sare_bayes_poison_nxm.cf 70_sare_evilnum0.cf occa_phishing.cf occa_replica.cf sa-blacklist.cf sa-blacklist.current.uri.cf tripwire.cf chickenpox.cf init.pre random.cf random.current.cf weeds2.cf local.cf The rules below were moved yesterday and placed in a different folder. Once I moved these and restarted spamassassin by rebooting the server it was no longer bogging down and duplicating emails. REMOVED YESTERDAY FROM /ETC/MAIL/SPAMASSASSIN 70_sare_evilnum1.cf 70_sare_evilnum2.cf 70_sare_header0.cf 70_sare_header.cf 70_sare_header_eng.cf 70_sare_html0.cf 70_sare_html1.cf 70_sare_html2.cf 70_sare_html3.cf 70_sare_html4.cf 70_sare_html_eng.cf 70_sare_oem.cf 70_sare_random.cf 70_sare_ratware.cf 70_sare_specfic.cf 70_sare_uri0.cf 70_sare_uri.cf 70_sare_whitlelist.cf 70_sare_whitelist_pre30.cf 72_sare_bml_post23x.cf 99_sare_fraud_post25x.cf antidrug.cf blacklist.cf blacklist-uri.cf bogus-virus-warnings.cf Here is the content of my config file for rules_du_jour: TRUSTED_RULESETS="TRIPWIRE ANTIDRUG SARE_EVILNUMBERS0 BLACKLIST BLACKLIST_URI RANDOMVAL BOGUSVIRUS SARE_ADULT SARE_FRAUD SARE_BAYES_POISON_NXM SARE_OEM SARE_RANDOM SARE_HEADER SARE_HEADER0 SARE_HEADER_ENG SARE_HTML0 SARE_HTML1 SARE_HTML2 SARE_HTML3 SARE_HTML4 SARE_HTML_ENG SARE_RATWARE SARE_SPECIFIC SARE_URI SARE_BML_POST25X SARE_WHITELIST SARE_WHITELIST_PRE30" SA_DIR="/etc/mail/spamassassin" MAIL_ADDRESS="[EMAIL PROTECTED]" SA_RESTART="killall -HUP spamd" I have quite a few users who get a lot of spam, especially pharmaceuticals and stocks delivered to their mailboxes. They are why I began trying to work on the spamassassin filtering. An interesting note I have observed but do not understand why it is happening. When I updated the rules on Monday, many users started seeing an increase number of spam in their mailboxes. One user who was getting a great deal of duplicate emails was also seeing a huge increase in the total numbers of spam emails. Where she would receive 100 spam emails per day before the rules_du_jour update, afterwards she was seeing 800 or 900 spam emails per day. Much of it was porn spam that she was not seeing before the update to the rules files. I would appreciate any advice and/or education offered on the spam filtering. Thanks, Steve Ingraham {^_^} ----- Original Message ----- From: "Steve Ingraham" <[EMAIL PROTECTED]> Steve Ingraham wrote: I need help with a problem. Our users are seeing some multiple duplicate emails coming from the same sender. This is not occurring with every email so there does not seem to be any pattern to which incoming emails will be duplicated and which ones won't. They are also reporting that duplicate emails are sent when they send to an outside email. Has anyone experienced this problem before? What could be causing this to occur and what can I do to stop this? I am running qmailtoaster and spamassassin as an external email gateway. There has been nothing changed with qmail but I did update some rules in SA using rules_du_jour yesterday. Would these rules updates cause this problem? If so, what would have changed? Jake Vickers wrote: If your system is low on resources (ie: RAM), then the spamd process can take too long, making Toaster think the mail got lost somewhere, so it resends it. Might want to check and see how much RAM you're using. I want to thank everyone who posted a reply on my inquiry. I believe Jake Vickers was right about the problem. The RAM on the email server was bogged down since yesterday when I updated the various .cf files using rules_du_jour. I had included just a handful of rules from RDJ but it appears that RDJ utilizes much too much of my server resources to use it to update my spamassassin rules. It was slowing down the server so much that simple functions were not responding. This appears to have affected the delivery of emails. In fact I noticed that my original message to these mail lists took several hours to post and were duplicated also. I resolved the problem by moving the various rules .cf files out of the /etc/mail/spamassassin folder and restarting spamassassin. If anyone has a simple way of updating rules for spamassassin I would welcome your input. I still need to update the rules as I have been getting a great number of emails coming through to users. Specifically, we are getting a lot of the pharmaceutical spam and the stock spam. Again, thanks to everyone for the posts. Steve Ingraham