[Mimedefang] Tracking down the delay (Razor timeout!)

[mfaurot at atww.org]

In article <40180BCD.4010305 at marine.rutgers.edu> you wrote:
> >
> > Perhaps setting these down to 5 seconds each and then restarting
> > everything might be a useful experiment.  If the delays drop after that,
> > you'll know you're in the right ballpark.

> Thanks, this seems like good advice!  I already had rbl_timeout at 5 so 
> I shortened razor_timeout to 5 also and sure enough, my delays are ~10 
> seconds now.

I looked through my own logs for today and noticed similar delays that
were in line with the settings for rbl_timeout and razor_timeout.  I
then checked my razor logs and there were numerous entries indicating
that SpamAssassin was reaching the timeout and giving up on Razor.  The
most current razor log entries seem to indicate Razor's difficulties may
have passed.

> So I guess my questions now are: How do I find & set up a good,
> reliable set of RBLs?

I personally have chosen not to use all of the various RBLs that
SpamAssassin uses by default and have instead just enabled
RCVD_IN_SBL[1], HABEAS_VIOLATOR[2], RCVD_IN_DYNABLOCK[3] and created my
own RBL rules to access SpamHaus' XBL list[4].

What I wound up doing was just looking through the SpamAssassin file
20_dnsbl_tests.cf and seeing what the various tests were.  I then looked
around at the URLs mentioned in the comments to get a feel for how each
of the lists was run.  In particular I was interested in the philosophy
of how things got added and removed from the lists and how well they
were technically set-up.  

I then decided on the lists mentioned above as they met my criteria.
You might wish to do something similar.  By only using a select group of
RBLs I figure I'm saving time (not having to query so many lists),
keeping inbound delays to a minimum and reducing the chance of false
positives.

> Do I need to invest a lot of time or can I automate it?

My suggestion would be to manually turn on one or two at a time and then
watch to see what happens over a period of time.


> Is this an anomaly with cloudmark's db/service or does 
> this kind of thing happen a lot?

I think this sort of thing does happen from time-to-time, thus the need
for the SpamAssassin "timeout" options.  


[1]: http://www.spamhaus.org/sbl/index.lasso
[2]: http://www.habeas.com/supportBlackList.html
[3]: http://www.dnsbl.us.sorbs.net/DUL-FAQ.html
[4]: http://www.spamhaus.org/xbl/index.lasso