Looking for low CPU usage Spam solution

kenel

Member
Mar 4, 2004
8
0
151
Hello Everyone,

I recently disabled Spamd because of load problems which dropped to about .30 / .20 after removing it. I, however, need a spam solution - cannot have no spam solution - and am looking for something that uses significantly less resouces than Spamassin. I've been reading about mailscanner, but that seems like it may be just as much trouble.

Anyone able to point me in the right direction, the help is greatly appreciated. Thank you.
 

RTCruiser

Active Member
Jun 28, 2006
36
0
156
Do a search for ASSP on sourceforge.net. I highly recommend it, and believe it will become the defacto spam filter for many if not most servers.
 

kenel

Member
Mar 4, 2004
8
0
151
the main thing we've noticed with SA is the memory usage. server load stays pretty much normal, but the memory usage by SA is considerable, increases memory usage by about 15%

other then that is works very well. I've been working on SA for a couple of weeks, fine tuning it, but can't get the memory usage to drop. But this maybe normal for SA.

Mickalo
Which I wouldn't have a problem with if it eliminated 95% of the spam. I've been tuning SA for a while...and I'm at about 65%, if that. Older e-mail accounts (8+ years) are at about a 30% success rate.
 

kenel

Member
Mar 4, 2004
8
0
151
With SPAMD enabled, what was the highest load? There are many variables involved here including server configurations. However, SpmAssassin (SA) shouldn't cause a server high load, if server and SA are configured properly.
Server is highly optimized and secured. SPAMD was causing an average load, in top, at low bandwidth times of 2.00 - 3.00. As soon as it was disabled, dropped to 0.2 to 0.3.
 

AndyReed

Well-Known Member
PartnerNOC
May 29, 2004
2,221
4
193
Minneapolis, MN
I recently disabled Spamd because of load problems which dropped to about .30 / .20 after removing it.
With SPAMD enabled, what was the highest load? There are many variables involved here including server configurations. However, SpmAssassin (SA) shouldn't cause a server high load, if server and SA are configured properly.
 

mickalo

Well-Known Member
Apr 16, 2002
782
5
318
N.W. Iowa
the main thing we've noticed with SA is the memory usage. server load stays pretty much normal, but the memory usage by SA is considerable, increases memory usage by about 15%

other then that is works very well. I've been working on SA for a couple of weeks, fine tuning it, but can't get the memory usage to drop. But this maybe normal for SA.

Mickalo
 

mickalo

Well-Known Member
Apr 16, 2002
782
5
318
N.W. Iowa
Which I wouldn't have a problem with if it eliminated 95% of the spam. I've been tuning SA for a while...and I'm at about 65%, if that. Older e-mail accounts (8+ years) are at about a 30% success rate.
we have about 90+ email accounts, and with add-on RulesDuJour and few sa-updates, we decreased our spam atleast 90% in the past couple of weeks.

We normally run about 35% mem usage, avg., but with SA, it kicks up to 47+% at times, usually during the day.

Mickalo
 

kenel

Member
Mar 4, 2004
8
0
151
I think I'm going to give ASSP a try. I remember hearing about this before, but never had the time to look into it. Thank you. Now if only I had CPanel install directions (better than the generic directions provided at assp.org).
 

mickalo

Well-Known Member
Apr 16, 2002
782
5
318
N.W. Iowa
I think I'm going to give ASSP a try. I remember hearing about this before, but never had the time to look into it. Thank you. Now if only I had CPanel install directions (better than the generic directions provided at assp.org).
let us know how that goes for you, I've looked at this ASSP awhile back, plus Chirpy's Cpanel MailScanner package, but haven't really made up my mind yet. Heard too many problems w/MailScanner also as I believe it also uses SA as a backend.

If you come across the Cpanel install instructions, please let me know :)

TIA,
Mickalo
 

RTCruiser

Active Member
Jun 28, 2006
36
0
156
let us know how that goes for you, I've looked at this ASSP awhile back, plus Chirpy's Cpanel MailScanner package, but haven't really made up my mind yet. Heard too many problems w/MailScanner also as I believe it also uses SA as a backend.

If you come across the Cpanel install instructions, please let me know :)

TIA,
Mickalo
It has nothing to do with SA. AAMOF, I disabled Spamassassin and spamd. My server load has dropped dramatically, and ASSP is much more effective.

FYI, I've been using SA for the past five years and never got better than about 60-65% effective filtering. I would say ASSP is closer to 99.999% effective.

I installed ASSP manually. The only thing you have to do is set exim to allow ASSP to use port 125, and if you have APF you need to add that port plus port 55555 in ingress and egress. That's really about all there is to it. The first two weeks you place it in test mode, and move false positives to the 'notspam' folder and false negatives to the 'spam' folder.

Also, I recommend subscribing to the ASSP newsletter digest and forum. Chances are any problems you'll run into have already been answered there.

Good luck!
 

mickalo

Well-Known Member
Apr 16, 2002
782
5
318
N.W. Iowa
It has nothing to do with SA. AAMOF, I disabled Spamassassin and spamd. My server load has dropped dramatically, and ASSP is much more effective.

FYI, I've been using SA for the past five years and never got better than about 60-65% effective filtering. I would say ASSP is closer to 99.999% effective.

I installed ASSP manually. The only thing you have to do is set exim to allow ASSP to use port 125, and if you have APF you need to add that port plus port 55555 in ingress and egress. That's really about all there is to it. The first two weeks you place it in test mode, and move false positives to the 'notspam' folder and false negatives to the 'spam' folder.

Also, I recommend subscribing to the ASSP newsletter digest and forum. Chances are any problems you'll run into have already been answered there.

Good luck!
thanks for the info and feeback. I will definiately take a closer look at ASSP this week.

We have SA configured now, after about 2wks worth of tweaking and fine tuning, filtering about 95% overall spam through about 90 email accounts on our server, which isn't bad.

Mickalo
 

randomuser

Well-Known Member
Jun 25, 2005
147
0
166
kenel - what version of perl are you using? I've seen spamd cause horrendous load issues when using an outdated version of perl. Other than that it's generally seemed pretty ok.
 

katmai

Well-Known Member
Mar 13, 2006
564
3
168
Brno, Czech Republic
using custom kernel compiled with grsec, by us, with chirpy's spam solution.

the server is hosting some heavy traffic websites and it's a p4 3.0 with 2 gb ddram, running centos 4.4.

chirpy mailscanner FE and all the addons - 35 $ absolutely great spam solution. very little load from that.

highly recommend.

also for a server hosting heavy visited websites, having a 3.00 load or 2.00 is not much. usually at peak time we get 3 4, and the sites load time make no difference from the server has 0.2 load.

second of all we use eaccelerator, which is a great at speeding up sites load. also mod gzip helps improving page loading time.
 

Solokron

Well-Known Member
Aug 8, 2003
851
1
168
Seattle
cPanel Access Level
DataCenter Provider
I am dealing with tremendous loads right now on one server. I am curious, how is ASSP effective if it runs on port 25?
 

Solokron

Well-Known Member
Aug 8, 2003
851
1
168
Seattle
cPanel Access Level
DataCenter Provider
I wish there was a better howto for cPanel users on this ASSP. It looks interesting but the config is very convoluted.
 

RTCruiser

Active Member
Jun 28, 2006
36
0
156
I wish there was a better howto for cPanel users on this ASSP. It looks interesting but the config is very convoluted.
The actual install is very simple. It's when you look at all of the possible settings that it can start to make your head spin.

The good news is the default settings are usually fine to start with.

I'll give you a basic "how to" for installing ASSP:

Download the latest stable version from sourceforge.net. Here's the URL: http://sourceforge.net/project/showfiles.php?group_id=69172

Unzip the file and upload the ASSP folder to your servers root directory.

Log in via SSH and cd to the ASSP folder. Enter "perl assp.pl" This will start the assp service.

ASSP uses exim, so you have to tell exim to send to ASSP. Log into WHM, click on Exim Configuration Editor under Service Configuration. Click on the Advanced Editor button and add this at the very top of the first text box:

Code:
# Redirect MTA to port 125 to enable ASSP
local_interfaces = 127.0.0.1.125
Then click the Save button.

IF YOU USE APF - open the APF config file ( /etc/apf/conf.apf) and add 125 and 55555 to both the Common ingress and Common egress ports. Save the file and restart APF (/usr/local/sbin/apf -r)

Log onto the ASSP control panel at http://yourserverIP:55555
The default login name can be anything, the password is nospam4me

Of course the first thing you'll want to do is change the password under the "Security" section.

Then go to the "TestModes" section and make sure everything is checked. The first couple of weeks ASSP will be learning what is spam and who should be on it's whitelist.

In the "Relaying" section add all domain names on your server in the "Local Domains" field.

The quickest way to make sure ASSP is working is to click the "SMTP Connections" tab and you should see a screen constantly updating with incoming and outgoing email messages. If it isn't, make sure that the "SMTP Destination" under Network Setup is set to: 127.0.0.1:125. In other words, make sure it's the same as the redirect you set in Exim config in WHM.

Your installation is now complete. But for the next couple of weeks you'll train ASSP to learn what is spam. ASSP puts email it thinks is spam in a folder called "Spam" and legitimate email in the "Notspam" folder. The documentation says to look in these folders and manually move any spam in the "Notspam" folder to the "Spam" folder and visa versa. I found it easier to use the "Copy All Spam" feature in the control panel. I set up a 'spamonly' email address for my domain and had ASSP just cc everything it thought was spam to that address. Then I would read each email header in my email client. If a legitimate email got caught I would just forward it to the "[email protected]" address. ASSP would then automatically add that to the "Notspam" list and add the sender to the whitelist.

After a couple of weeks you will be sending very few email messages to the "Notspam" address and you can go live by simply unchecking all of the "TestMode" checkboxes, then SSH into your server's ASSP directory and run 'perl rebuildspamdb.pl'. (This process can initially take up to 20 or 30 minutes if you have a slow processor so do it during an appropriate time of day.)

[edit]
You can then disable SpamAssassin by going to WHM, in the "Service Configuration" section, click the Service Manager link and uncheck spamd under both the Enabled and Monitored columns.

Then (still in WHM), under "Server Configuration" click Tweak Settings and uncheck Spamassassn and Boxtrapper.
[/edit]

The only thing left to do is to set up a cron job to run "perl rebuildspamdb.pl" every day so that the spam database is kept current.

That's it! Keep in mind, these are my personal recommendations using ASSP with Cpanel. I am not responsible if you muck up your server playing around in SSH. (Although things can be brought back to your old status fairly easily by removing the redirect in exim manager and re-enabling Spamassassin and spamd in WHM).

There are a TON of options for you to customize ASSP I haven't even touched on, like being able to bypass entire domains if you're clients WANT to receive spam, email addresses clients can use to report spam or add email addresses to the whitelist, etc., etc, etc., all handled in the Web based control panel.

Finally, here are some helpful Web sites I use for reference:

http://sourceforge.net/forum/forum.php?forum_id=235333
http://www.asspsmtp.org/wiki/Recommended_settings
http://www.asspsmtp.org/wiki/Special:Allpages
http://www.nabble.com/Anti-Spam-SMTP-Proxy-Server-f3861.html
http://www.asspsmtp.org/wiki/BombRe_and_ScriptRe

and the excellent documentation inside of the ASSP folder itself: ASSP%20Documentation.htm
 
Last edited:

mickalo

Well-Known Member
Apr 16, 2002
782
5
318
N.W. Iowa
The actual install is very simple. It's when you look at all of the possible settings that it can start to make your head spin.
Unzip the file and upload the ASSP folder to your servers root directory.

Log in via SSH and cd to the ASSP folder. Enter "perl assp.pl" This will start the assp service.
one question regarding the installation folder, is there a specific folder this needs to be installed in, IE: /root/ASSP
or can it be anywhere ??

Thx's for the great HOWTO :)

Mickalo
 

Solokron

Well-Known Member
Aug 8, 2003
851
1
168
Seattle
cPanel Access Level
DataCenter Provider
Looks good.

In the "Relaying" section add all domain names on your server in the "Local Domains" field.

This does not seem very practical for a web server with new accounts coming in and out all the time. Too bad it is not designed to work with a file such as /etc/localdomains