Re: Mail server load

On Wed, 20 Aug 2003, Nigel J. Andrews wrote:

> On Wed, 20 Aug 2003, Dennis Gearon wrote:
>
> > holy S**T!!
>
> Particularly the 'Passed' number. Now I'm not subscribed to all of the lists
> but I am on -general, -hackers and a couple of others like -interfaces and yet
> I would say that the volume of email I'm seeing from the lists is far lower
> than normal _not_ more by a factor of 3-ish.

The # Passed is what amavisd passed through to majordomo2 ... majordomo2
then takes everything that amavisd marked as being spam and trashes those
... and then everything that is from ppl not subscribed to the lists has
to get approved by 'the moderator', which I'm currently going through ...
only 400 more to go, 399 of which are most likely stuff amavisd didn't
catch as spam *sigh*

Oh ... also consider that a *very* large portion of the messages that
Passed are also postmaster messages for messages bounced ... I have a
filter on my mail for that to put it into its own mailbox ... since Aug
18th, there have been 12622 messages delivered to that mailbox ... and
there is also all the subscribe/unsubscribe requests ... all of which
would have been Passed thorugh amavisd ...

>
> >
> >
> > The Hermit Hacker wrote:
> >
> > > 16:00 ...
> > >
> > > neptune# awk '{print $7}' /var/log/amavisd | sort | uniq -c
> > > 285 BAD
> > > 1807 BANNED
> > > 12289 INFECTED
> > > 11731 Passed,
> > > 5 SA
> > > 1 turned
> > >
> > > Here's a normal day:
> > >
> > > neptune# cat /var/log/amavisd.o | grep "Aug 17" | awk '{print $7}' | sort
> > > | uniq -c
> > > 332 BAD
> > > 13 BANNED
> > > 938 INFECTED
> > > 3792 Passed,
> > >
> > >
> > >
> > > On Wed, 20 Aug 2003, Tom Lane wrote:
> > >
> > >
> > >>"Nigel J. Andrews" <nandrews(at)investsystems(dot)co(dot)uk> writes:
> > >>
> > >>>Yesterday you had almost 1 for 1 valid email. By then I think I was getting
> > >>>about 3-4 per valid email but since then it's sky rocketed and it looks more
> > >>>like 30+ per 1 valid message.
> > >>
> > >>FWIW, this is what I see in traffic to an address I've had to abandon
> > >>because of spam:
> > >>
> > >> 488 Aug 8
> > >> 433 Aug 9
> > >> 435 Aug 10
> > >> 426 Aug 11
> > >> 504 Aug 12
> > >> 458 Aug 13
> > >> 469 Aug 14
> > >> 390 Aug 15
> > >> 433 Aug 16
> > >> 371 Aug 17
> > >> 520 Aug 18
> > >>36473 Aug 19
> > >>35808 Aug 20
> > >>
> > >>It's about 3pm local time here, so by midnight the stat for today will
> > >>probably be nearly double yesterday's total.
> > >>
> > >>The spam traffic had been around 2K/day at the beginning of the year,
> > >>but tapered off to around 500 as you see above. This spike is ten times
> > >>the highest I've seen before. If I were actually downloading this crap,
> > >>and not rejecting it at the SMTP handshake, my DSL line would be
> > >>saturated :-(
>
>

Marc G. Fournier ICQ#7615664 IRC Nick: Scrappy
Systems Administrator @ hub.org
primary: scrappy(at)hub(dot)org secondary: scrappy(at){freebsd|postgresql}.org