On Friday 13 October 2006 21:06, Sam Varshavchik wrote:
Would it be reasonable to script up something that could
roll over the messages in the queue and "purge" the most
obvious spam quickly and easily ?
That'll work, but you'll have to run the 'courier cancel' command
to purge each individual message, or stop Courier before manually
removing the three files in the queue directories, per each message.
Thanks for the hint. I'll look into the best way to grep for
the most obvious signs of a spam message and probably stop
the esmtpd server for a few minutes while some script runs.
For now, we just bit the bullet and stopped Spamassassin and
sure enough the mailq is dropping by about 200 msgs per minute
so in a couple of hours we'll re-engage SA but on an empty queue.
Many users will have an extra few dozen spams each but they'll
also have all backed up mail from up to 48 hours ago.
One small thing that was useful was this alias so that we
didn't have to run the mailq command just to see how many
msgs are in the queue...
# alias mq
alias mq='find /var/lib/courier/msgq -type f | wc -l'
BTW can anyone suggest a more efficient spam filter other than
SpamAssassin is the best spam filter around, but you do have to be
careful of how you use it to prevent problems like you had here.
- Use spamc/spamd rather than calling spamassassin directly
- Don't run excessivly large add-on rulesets
- Make sure you have enough memory to support the number of spamd
children you specify.
Ask on the SpamAssassin mailling list for more detailed suggestions
for your configuration.