[Mimedefang] making spamassassin less sensitive

[Justin]

On Wed, 4 Feb 2004, Muhammad Talha wrote:

> RAM 256MB

Ouch.  This is going to hurt you.

> Swap 512

Yikes!

> Sendmail-8.11.12

8.12.11?

> Clamav-0.65

Upgrade to the latest snapshot.  0.65 is buggy.

> Due to lack of RAM system sometime take all the Ram+Swap and i have to
> restart mimedefang

Ok, you definitely need more RAM.  Since you have a PIII, is it safe to 
assume your box takes PC133 (not always the case but the odds are good).  
RAM is ubber cheap.  Buy a lot of it because you'll need it.  If you go 
over a certain threshold you'll need to roll a new kernel to take 
advantage of it.  It's not really that hard.

> i want to make Spamassain less sensitive so that i can save more memory.
> Steps i want to take
> 
> 1) Change mimedefang-filter
> 
> if (-s "./INPUTMSG" < 100*1024) {
> 
> TO
> 
> if (-s "./INPUTMSG" < 50*1024) {

This isn't a bad idea if your spam is usually under 50k.  You need to 
build up a large corpus of spam (procmail is your friend) to examine for 
your average spam message size to be certain.

> 3) change mount /var/spool/MIMEDefang as tmpfs ( size 256m )

Good idea.  Disks are slow.  How much mail do you normally handle though?  
What's the max attachment size you've configured Sendmail to allow?  
What's the maximum number of sendmail slaves you allow?  Max MD slaves?  
Simply put you need as much space in your spool as the largest attachment
size Sendmail will allow times the maximum number of MD slaves, and then
some.  I say 'and then some' because decompressing attachments for virus
scanning will add to this.  Failed messages saved in the spool will also
add to this (if you save any).  tmpfs is a good thing but don't be afraid
to go overboard.  You can't put too much RAM in a box.  Well, I suppose 
it's possible that you could hit the upper limit that your specific 
machine can recognize but...   This page will help you.

http://www.mimedefang.org/node.php?id=28

> 5)  Should i had to remove some rules from /usr/share/spamasssain ??

If you're running with the stock MD filter and SA rules then none of the 
network tests (DNSBL, Razor, Pyzor, DCC) checks are being run.  These 
usually add network delay but they can also affect overall performance.  
Really there isn't anything that you can drop at this point to lessen the 
load.  Consider getting and SMP box.  I don't build or buy any single 
processor boxes any more since SMP boxes can be had for very little more.


Moral of the story:  RAM, RAM and more RAM.  When you think you have
enough, double it.  Also use the available limits within Sendmail and MD
to prevent possible runaway train wrecks with respect to your available
resources.  You can never be too safe.

HTH
 Justin