How Much CPU Load Does Your Spam Filter Put On Your VPS
Jul 8, 2007
How much CPU & RAM load does your spam filter put on your VPS? It seems logical that the more mailboxes hosted, the more VPS resources the spam filter will consume - especially if any of the email addresses are targeted by spammers (or the user is careless and gives out their email address everywhere - as many do).
It's become so much with some of our subscribers that we have had to offer a hardware spam filter, to keep the load off the VPS. It's been great in that the VPS's protected by it have seen a dramatic performance increase....but are these subscribers unique in some way?
And so here is my question...how much CPU is everyone's spam assassin/spam filter using and how many mailboxes do you host on your VPS? very curious...
View 8 Replies
ADVERTISEMENT
Apr 23, 2008
As a web host or ISP what do you think is best to do? do spam/virus filtering, or don't touch mail and let the user do what they want with it? (no chance of false positives, or lost mail, this way)
I work for an ISP and we have a barracuda and we get tons of calls from customers regarding lost mail and such as when you're filtering such a large varitey of mail its very hard to have a "perfect" filter. Mail that a car dealership gets and what a hospital get is totally different, for example.
Also in terms of web hosting the filtering will put a reasonable load on the server during peak spamming hours.
So just curious, as a ISP/webhost customer do you think your host should do filter or do you rather manage that yourself?
View 10 Replies
View Related
May 28, 2009
We have identified that messages from your IP are being filtered based on the recommendations of the Symantec Brightmail filter as well as our internal Smart Screen Filters. The filter was initiated by Hotmail at (5/20/2009 12:00:00 AM) PST due to a large volume of emails that were sent prior to this time.
We will be happy to work directly with Symantec on your behalf to investigate and possibly resolve this problem. In order to move forward, we will need examples of the messages that were caught by the Brightmail filters.
View 3 Replies
View Related
Jun 30, 2008
I am running a small hosting operation and would like to know more about SPAM filtering and controlling. SpamAssasin is installed on my server but it does not do much. I was looking into different solution with a anti-spam device and would like to know which one is recommended the most: sonicwall, barracuda or symantec? (total email addresses is less than at thousand)
View 4 Replies
View Related
Apr 9, 2007
Anyone else have problems with Yahoo Spam filters being overzealous? I recently setup a new domain and a few email accounts. After sending a few test messages to my Yahoo email, each one of them was flagged as spam. I changed the text to a more regular email, with no controversial words and still the same result. I notice that Yahoo regularly traps some newsletters I subscribe to in my spam filter, but rarely, if ever legitimate emails. I checked with my web host who informed me they are not on any spam blacklists and that I would have to contact Yahoo. Yahoo's help is quite a maze (designed to make you lose interest and move on), so before I continue hunting for how to contact Y!, I thought I would come here to see if this is a common problem (with a common fix).
View 1 Replies
View Related
Aug 9, 2007
I'm wondering if theres anything I can install on the server that will either filter or track outgoing spam. I don't want to limit the number of emails sent per hour or anything, I just want to be able to maybe search through some flagged emails or something. Or if they send the exact same email more than x times it can disable their account... I'm not sure
View 1 Replies
View Related
Nov 30, 2007
I just found out all my mails sent to Gmail are marked as spam. However, if I check my IP address in independant grass-root spam databases, my IP address isn't blacklisted. I checked 7 of them. Do you know how to solve this problem
View 6 Replies
View Related
Nov 20, 2007
i was wondering if there is any other free anti-spam filter other than Spam Assassin that can be used on a VPS account?
View 13 Replies
View Related
Sep 8, 2014
A few months before I updated to Plesk 12 I noticed a huge jump in uncaught spam - I hoped the update to Plesk 12 might solve this but no luck.
I have now changed the spam sensitivity on my account 1, the idea being I would then whitelist the domains I want to get through but literally nothing is getting marked as spam. Users on other domains on the same server are reporting the same.
I'm using the following blacklist database lists:
zen.spamhaus.org;dnsbl.dronebl.org;bl.spameatingmonkey.net;psbl.surriel.com;b.barracudacentral.org
I have Plesk SpamAssassin 3.3.2 installed and set as the Spam handler.
View 6 Replies
View Related
Apr 15, 2008
switched to ipower.com and not getting any help - really stuck as my customer wanted better spam filtering so I went to them on a recommendation and I do not know how to turn on and what is the best setting for spam filtering with their panel. Also using HORDE where I can set a filter using rules but it only works if I log on and hit apply filter so my customer still gets it in his in box -
View 2 Replies
View Related
Jul 18, 2014
I am happily running Plesk 11.5; with just one small but annoying persistent problem:
I have Clients with large mailinglistes
- SpamAssassin
- Server-wide greylisting
- DNSBL
is running.
But apparently many of the lists mail addresses have been harvested over the years. And as there is no easy way to use SA in mailman, I am down to greylisting only for list addresses.
This results in insanely large amounts of SPAM (-> moderation requests) on the client's lists. Is this behavior improved in Plesk 12?
Or can probably SIEVE filters work here - are those available to mailman? (probably not as they work in Dovecot?)
View 2 Replies
View Related
Apr 3, 2015
Almost all mail adresses on my server is getting a spam mail from same mail marketing company everyday and i want to block them... Normally i just add the mail address to blacklist from "Spam Filter Settings" but this company is opening new addresses everyday and it is impossible to add all of them to blacklist so i need adding it as a regex to the blacklist...
The company i am talking about is opening mail addresses every day like below...
nrt150401@hotmail.com
nrt150402@gmail.com
nrt150403@yandex.com
nrt150404@mynet.com
As you can see all mail addresses begin with "nrt"+"6 digits of day"+"free mail provider", so right now i am using the regex below and it is already added to the blacklist but they are still able to send me... What can i do now?
View 3 Replies
View Related
Jul 24, 2014
I can only add 100 addresses to the global address spam white list. I need to add more!
View 1 Replies
View Related
May 7, 2013
when im trying to enable spam filter for a particular email account i get this mysql error:
Error: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry 'xxxx@domain.com' for key 3 (mail id i hid it for security reasons xxxx@domain.com)..
i searchd in the psa database but could not find any duplication...
View 2 Replies
View Related
Mar 8, 2008
after noticing the SQL errors on my sites, I went in to take a closer look.
First thing I noticed was my server load was at 200! This was all due to EXIM!
I stopped exim and then watched my load go back down to like 1... then started it, and it gradually rose again.
After using the Exim Cheat Sheet...
I discovered I had over 7000 messages frozen in my que and a few thousand not frozen.
After erasing all of the frozen messages because they were all spam, I am left wondering what I can do to stop this from happening again...
1. Is this spam being SENT FROM me? Or TO me?
2. Regardless of the answer to #1, how do I make it stop? I don't host any significant sites, and the server only has a few sites on it. None of the domains match up with anything I have anything to do with, so its all worthless and nobody on my server heavily uses their email through me.
What do I do? This is the second time I have had my system with a load this high and after the first time, I paid a chunck for more RAM.
View 4 Replies
View Related
Dec 17, 2007
I'm having problems with incoming spam on my dedicated server the load average of the server is around 80 or 100.2 I know it's incoming spam because when I check the exim process I see a lot of ips from russia, germany, taiwan then I block that ips with the /etc/apf/apf -d ip command and then the load of the server drops down to 7 or less, so the cuestion is how can I detect and block the spammers ips automatically on the server? I have spam assassin running and blocks the spam emails right, the real problem is the high load generated for spamd application and all the incoming connections of the spammers ips on the server.
Server specifications:
Cent OS 4
Control panel: directadmin
Dual-Core AMD Opteron(tm) Processor 2214 HE
1GB RAM
Exim 4.68
Apache 1.3.39
MySQL 5.0.37
vm-Pop3d 1.1.7f-DA-2
View 8 Replies
View Related
Oct 17, 2013
Microsoft Windows Server 2008 R2 Service Pack 1
Panel version 11.0.9 Update #59, last updated at Oct 3, 2013 02:06 AM
MailEnable version 5
I see in the plesk documentation that the screen to enable SPAM filtering for an individual there is an option to "Move spam to the Spam folder". I don't see that option so I am wondering if it is only available on some versions of Plesk, or in combination with certain mail servers. How to make that option available?
View 3 Replies
View Related
Dec 20, 2007
I've been having trouble with my VPS for a while now. In the QoS alerts page in Virtuozzo it seems to be a problem with numtcpsock and tcprcvbuf, mainly numtcpsock.
Copy these into the browser:
i18.photobucket.com/albums/b106/gnatfish/qosnumtcpsock2.jpg
And when i run cat /proc/user_beancounters:
i18.photobucket.com/albums/b106/gnatfish/beancounters2.jpg
This line is particularly scary:
numtcpsock 164 164 166 166 7321
What do i need to do, to get the website running again? It's only one site on the vps a proxy. So i thought a vps would be able to handle one proxy.
View 1 Replies
View Related
May 6, 2008
Anyone know of some good server load testers ( commercial )?
Im not looking for application based load testing, I need real web server load testing... need to see how much traffic this one site can take before it cries.
View 1 Replies
View Related
Jan 21, 2007
I would like to know how to filter more than one NIC with APF firewall... at the moment, it only let you filter Eth0, how do I add Eth1 in it as well?
View 7 Replies
View Related
Jan 22, 2009
I am getting a VPS and the only mail filter option available with this company is SpamAssassin.
Is Spam Assassin's version 3.2.x sufficient to block majority of Spam/Junk emails?
View 9 Replies
View Related
Mar 4, 2007
I sent the below email, it keeps getting caught in the filter
Quote:
Maria,
Here are the username and password for this site.
www.consumerreports.com [url]
user:
pass:
Maybe you can find some more info about the cars you like.
Thanks,
Matthew
Sitebuilder Specialist
[800.729.xxxx ext xxx] or [xxx.625.8546]
email malberty@domain.com
www.anotherdomain.com
Support Contact for any Stewart Related Website:
[url]<[url]
The exim logs show this:
2007-03-04 21:02:53 1HO3TR-0003tu-Ek <= matthew@localdomain.com H=(localhost) [127.0.0.1]:43496 I=[127.0.0.1]:25 P=esmtpa A=fixed_login:matthew@localdomain.com S=1527 id=9bb87bf2893bf84500323930692044ef@localhost T="test" from <matthew@localdomain.com> for matthew@localdomain.com
2007-03-04 21:02:53 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1HO3TR-0003tu-Ek
2007-03-04 21:02:53 1HO3TR-0003tu-Ek => discarded (system filter)
2007-03-04 21:02:53 1HO3TR-0003tu-Ek Completed QT=0s
2007-03-04 21:02:53 SMTP connection from (localhost) [127.0.0.1]:43496 I=[127.0.0.1]:25 lost
I cannot figure out why the filters is picking this up, nor which WORD is causing this. How would I trace this?
my antivirus.exim file
Code:
# Exim filter
## Version: 0.17
#$Id: system_filter.exim,v 1.11 2001/09/19 11:27:56 nigel Exp $
## Exim system filter to refuse potentially harmful payloads in
## mail messages
## (c) 2000-2001 Nigel Metheringham <nigel@exim.org>
##
## This program is free software; you can redistribute it and/or modify
## it under the terms of the GNU General Public License as published by
## the Free Software Foundation; either version 2 of the License, or
## (at your option) any later version.
##
## This program is distributed in the hope that it will be useful,
## but WITHOUT ANY WARRANTY; without even the implied warranty of
## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
## GNU General Public License for more details.
##
## You should have received a copy of the GNU General Public License
## along with this program; if not, write to the Free Software
## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
## -A copy of the GNU General Public License is distributed with exim itself
## -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
## If you haven't worked with exim filters before, read
## the install notes at the end of this file.
## The install notes are not a replacement for the exim documentation
## -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
## -----------------------------------------------------------------------
# Only run any of this stuff on the first pass through the
# filter - this is an optomisation for messages that get
# queued and have several delivery attempts
#
# we express this in reverse so we can just bail out
# on inappropriate messages
#
if not first_delivery
then
finish
endif
## -----------------------------------------------------------------------
# Check for MS buffer overruns as per BUGTRAQ.
# [url]
# This could happen in error messages, hence its placing
# here...
# We substract the first n characters of the date header
# and test if its the same as the date header... which
# is a lousy way of checking if the date is longer than
# n chars long
if ${length_80:$header_date:} is not $header_date:
then
fail text "This message has been rejected because it has
an overlength date field which can be used
to subvert Microsoft mail programs
The following URL has further information
[url]
seen finish
endif
## -----------------------------------------------------------------------
# These messages are now being sent with a <> envelope sender, but
# blocking all error messages that pattern match prevents
# bounces getting back.... so we fudge it somewhat and check for known
# header signatures. Other bounces are allowed through.
if $header_from: contains "@sexyfun.net"
then
fail text "This message has been rejected since it has
the signature of a known virus in the header."
seen finish
endif
if error_message and $header_from: contains "Mailer-Daemon@"
then
# looks like a real error message - just ignore it
finish
endif
## -----------------------------------------------------------------------
# Look for single part MIME messages with suspicious name extensions
# Check Content-Type header using quoted filename [content_type_quoted_fn_match]
if $header_content-type: matches "(?:file)?name=("[^"]+\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc])")"
then
fail text "This message has been rejected because it has
potentially executable content $1
This form of attachment has been used by
recent viruses or other malware.
If you meant to send this file then please
package it up as a zip file and resend it."
seen finish
endif
# same again using unquoted filename [content_type_unquoted_fn_match]
if $header_content-type: matches "(?:file)?name=(\S+\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]))"
then
fail text "This message has been rejected because it has
potentially executable content $1
This form of attachment has been used by
recent viruses or other malware.
If you meant to send this file then please
package it up as a zip file and resend it."
seen finish
endif
## -----------------------------------------------------------------------
# Attempt to catch embedded VBS attachments
# in emails. These were used as the basis for
# the ILOVEYOU virus and its variants - many many varients
# Quoted filename - [body_quoted_fn_match]
if $message_body matches "(?:Content-(?:Type:(?>\s*)[\w-]+/[\w-]+|Disposition:(?>\s*)attachment);(?>\s*)(?:file)?name=|begin(?>\s+)[0-7]{3,4}(?>\s+))("[^"]+\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc])")[\s;]"
then
fail text "This message has been rejected because it has
a potentially executable attachment $1
This form of attachment has been used by
recent viruses or other malware.
If you meant to send this file then please
package it up as a zip file and resend it."
seen finish
endif
# same again using unquoted filename [body_unquoted_fn_match]
if $message_body matches "(?:Content-(?:Type:(?>\s*)[\w-]+/[\w-]+|Disposition:(?>\s*)attachment);(?>\s*)(?:file)?name=|begin(?>\s+)[0-7]{3,4}(?>\s+))(\S+\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]))[\s;]"
then
fail text "This message has been rejected because it has
a potentially executable attachment $1
This form of attachment has been used by
recent viruses or other malware.
If you meant to send this file then please
package it up as a zip file and resend it."
seen finish
endif
## -----------------------------------------------------------------------
#### Version history
#
# 0.01 5 May 2000
#Initial release
# 0.02 8 May 2000
#Widened list of content-types accepted, added WSF extension
# 0.03 8 May 2000
#Embedded the install notes in for those that don't do manuals
# 0.04 9 May 2000
#Check global content-type header. Efficiency mods to REs
# 0.05 9 May 2000
#More minor efficiency mods, doc changes
# 0.06 20 June 2000
#Added extension handling - thx to Douglas Gray Stephens & Jeff Carnahan
# 0.07 19 July 2000
#Latest MS Outhouse bug catching
# 0.08 19 July 2000
#Changed trigger length to 80 chars, fixed some spelling
# 0.09 29 September 2000
#More extensions... its getting so we should just allow 2 or 3 through
# 0.10 18 January 2001
#Removed exclusion for error messages - this is a little nasty
#since it has other side effects, hence we do still exclude
#on unix like error messages
# 0.11 20 March, 2001
#Added CMD extension, tidied docs slightly, added RCS tag
#** Missed changing version number at top of file :-(
# 0.12 10 May, 2001
#Added HTA extension
# 0.13 22 May, 2001
#Reformatted regexps and code to build them so that they are
#shorter than the limits on pre exim 3.20 filters. This will
#make them significantly less efficient, but I am getting so
#many queries about this that requiring 3.2x appears unsupportable.
# 0.14 15 August,2001
#Added .lnk extension - most requested item :-)
#Reformatted everything so its now built from a set of short
#library files, cutting down on manual duplication.
#Changed w in filename detection to . - dodges locale problems
#Explicit application of GPL after queries on license status
# 0.15 17 August, 2001
#Changed the . in filename detect to S (stops it going mad)
# 0.16 19 September, 2001
#Pile of new extensions including the eml in current use
# 0.17 19 September, 2001
#Syntax fix
#
#### Install Notes
View 1 Replies
View Related
Mar 5, 2008
I want to filter any files uploaded and i have put this line at php.ini
suhosin.upload.verification_script = /my path
But my problem till now i can not make this script. (Disable upload php files)
View 1 Replies
View Related
Jan 3, 2008
I have A/B power from my colo provider, each fed from separate xxxKVA UPSes. I have dual-cord servers powered from these two circuits.
Now I'm adding an EMC SAN, which comes with its own little APC UPS. EMC says the SAN's A-side power should come from my A-side circuit, and the SAN's B-side power should come from the included little APC UPS, which should be plugged into my B-side circuit.
Unfortnately, the little UPS puts out lots of garbage line noise on the upstream side. I know this because I plugged it in at home, and it was turning my X10 light fixtures on and off when the battery would hit a charging cycle. This is not the kind of dirty power I'd like to be feeding to the servers.
Does anyone have a suggestion for cleaning up the harmonic distortion that these UPSes send back upstream? Maybe a Tripp Lite IBAR12/20ULTRA? Or a Tripp Lite IS-1000 Full Isolation Transformer?
Alternatively, if there is a way to tell the EMC SAN to enable write caching without the APC UPS, that might work, too.
View 6 Replies
View Related
Apr 1, 2007
I am on a DirectAdmin server, with root access. Exim mail server.
Is there any way to filter outgoing messages? Let's say if IP of client is listed in blacklist, they can not send out emails
View 2 Replies
View Related
Mar 26, 2007
I have the same problem as many other users who try to send to Hotmail.... my e-mails are being put into the junk filter.
Could you please help me with this as I am going mad trying to figure out how to fix this? I am running a VPS which has 4 IP's and whenever I send an e-mail from the domain it moves into the junk filter. E-mails are received correctly by other e-mail providers (Yahoo, etc.), only Hotmail has the issue.
When I do a DNS Report, the only error I get besides the mail server having a single point of failure, is "Mail server host name in greeting". I have had the VPS provider add a RDNS entry, etc.
I have spoken with the support team at the VPS Host and they have tried everything they could and can't understand why there is an issue. I also contacted Hotmail and they redirected me to a Junk Filter troubleshooting page [url]
I don't know why this is being filtered as Junk and what I can do to fix it. Could you please help as I would be most grateful.
Is someone able to PM me with help as I would prefer not to post the network/website details on the forum please?
View 1 Replies
View Related
