Page 2 of 2 FirstFirst 12
Results 11 to 20 of 20
  1. #11
    Untangle Ninja dwasserman's Avatar
    Join Date
    Jun 2008
    Location
    Argentina
    Posts
    4,375

    Default

    Can you post the header and subjet of one mail passed by untangle and catched by barracuda?
    Sound strange the behavior that you describe.

  2. #12
    Master Untangler JEllingson's Avatar
    Join Date
    Jan 2008
    Location
    Warner Robins, GA
    Posts
    342

    Default

    Contact Dirk (or one of the other Untangle guys). I can't find it right now, but there is a grep you can do on the UVM logs to see if/when the system is failing over to "pass" the email due to load or scan triggers. I still suspect that you are exceeding what your box can handle. -- I know Juank has a ridiculusly fast box to handle his emails without dropping/passing them through.

  3. #13
    Master Untangler JEllingson's Avatar
    Join Date
    Jan 2008
    Location
    Warner Robins, GA
    Posts
    342

    Default

    As for the J&J Script, it enables several network-based scans and adds a few additional rules to the SpamAssassin engine built into SpamBlocker.

    It isn't "documented" (I know -- shame on Juank and I for not doing so)... but is just a simple script to grab the files needed and compile them into the system.

    You are welcome to ask questions about it and/or inspect the code yourself.

  4. #14
    Untanglit
    Join Date
    Jan 2010
    Posts
    24

    Default

    I will try out this script and see what it does. Where is the script located and how do I execute it?

    I will snag an email tomorrow and post the header.

    As for my horsepower...I am running 2 dual core xeons 32 bit with 4gb of RAM. When testing it today I only had SPAM and Phishing running. I did have the spyware filter running off and on through out the day but it didnt seem to make any changes. That doesnt seem like much running to be under powered. CPU load averaged around 1 and 2. With spyware on it was like 4 and 5.

  5. #15
    Master Untangler JEllingson's Avatar
    Join Date
    Jan 2008
    Location
    Warner Robins, GA
    Posts
    342

    Default

    You'll find the J&J Script in the SpamBlocker forum here. It is one of the topics. Just keep in mind that you should NOT install the BOTNET option if you have WAN users sending email through your LAN mail server over SMTP port 25. It works GREAT if your users are also on the LAN side, or use port 587/465 (alt SMTP/SSL SMTP) if they are on the WAN side.

    I have been out of developing for SpamBlocker for a few months now. So I took a little time last night to review some of my optimizations for high-use servers and recalled a couple of settings that should be changed for your work-load.

    I'll be working on a new J&J script that will include these new changes. For the average user, it'll not help much (this is where the current J&J Script is aimed at), but for high-traffic users like you, it should greatly improve the performance.

  6. #16
    Untanglit
    Join Date
    Jan 2010
    Posts
    24

    Default

    Okay, some more information. I have the header of an email that did not scan through the untangle box listed below. I do not know if barracuda strips the original header or not but there it is. I x'd out all the names and domains.

    I went into the even log of the spam filter and counted all the emails (passed, q'd, dropped) for the minute of 10:26. I only counted 4. When I login to the barracuda and look at 10:26 there are 18. Including all 4 that went through Untangle. Thats my problem......

    X-ASG-Debug-ID: 1266423995-510200180000-tKV7djX-Barracuda-URL: http://x.x.x.x:8000/cgi-bin/mark.cgi...uda-Orig-Rcpt: xxxxxx@xxxxxx.usReceived: from fmailhost04.isp.att.net (localhost [127.0.0.1]) by barracuda.xxxxxxx.us (Spam & Virus Firewall) with ESMTP id 200583C8205 for <xxxxxxx@xxxxxxx.us>; Wed, 17 Feb 2010 10:26:35 -0600 (CST)Received: from fmailhost04.isp.att.net (fmailhost04.isp.att.net [204.127.217.104]) by barracuda.xxxxxxxx.us with ESMTP id cVRFD12V0ToAPKXD for <xxxxxxx@xxxxxxxx.us>; Wed, 17 Feb 2010 10:26:35 -0600 (CST)X-Barracuda-Envelope-From: xxxxxx@bellsouth.netX-ASG-Whitelist: SenderReceived: from kirk (adsl-95-59-173.jan.bellsouth.net[98.95.59.173]) by isp.att.net (frfwmhc04) with SMTP id <20100217162621H0400rddpre>; Wed, 17 Feb 2010 16:26:21 +0000X-Originating-IP: [98.95.59.173]Message-ID: <008201caafed$a6622400$0b01a8c0@kirk>From: "xxxxx xxxxxx" <xxxxxx@bellsouth.net>To: "xxxxxx xxxxx" <xxxxxxx@xxxxxx.us>, "xxxxx xxxxx" <xxxxxx@nmhs.net>X-ASG-Orig-Subj: Fw: SimilaritiesSubject: Fw: SimilaritiesDate: Wed, 17 Feb 2010 10:24:15 -0600MIME-Version: 1.0Content-Type: multipart/related; boundary="----=_NextPart_000_007E_01CAAFBB.5B318E80"; type="multipart/alternative"X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2900.3138X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198X-Barracuda-Connect: fmailhost04.isp.att.net[204.127.217.104]X-Barracuda-Start-Time: 1266424000X-Barracuda-Virus-Scanned: by Barracuda Spam & Virus Firewall at xxxxxx.us

  7. #17
    Master Untangler JEllingson's Avatar
    Join Date
    Jan 2008
    Location
    Warner Robins, GA
    Posts
    342

    Default

    I'm still guessing that too many emails are hitting your server and that there aren't enough SpamD children to process them all fast enough... so it just lets the message go through unchecked. -- and when I say "fast enough", it isn't that your server is being loaded down doing calculations... each SpamD child is being tied up a few seconds waiting for RBL responses from the Internet.

  8. #18
    Untanglit
    Join Date
    Jan 2010
    Posts
    24

    Default

    That makes sense to me. Will that script help that?

  9. #19
    Master Untangler JEllingson's Avatar
    Join Date
    Jan 2008
    Location
    Warner Robins, GA
    Posts
    342

    Default

    Not what is currently posted in the forums.

    However, my new version of the script (being rewritten from ground up) will.

    The new script is early in development and may not be available until sometime next week.

  10. #20
    Untangle Ninja dwasserman's Avatar
    Join Date
    Jun 2008
    Location
    Argentina
    Posts
    4,375

    Default

    This issue exceeds my knowledge, assumes that all mail passing through the antispam of untangle, but 18 mails x minute maybe is too much. Your hardware is well-sized? CPU, mem.
    The log show this mail pass or is missing in the log?
    And waht number have your threshold? If medium, change to next threshold high, and so.

Page 2 of 2 FirstFirst 12

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2