SPAM Module Overloaded?

[pauljones_2]

Hi,

I have been running a couple of Untangle servers here for a few months now and I have been really impressed so far.

Unfortunately however since the upgrade to 6.1, I have been having a real problem with the SPAM module. I had Untangle 6.0.2 running on a Dual Processor AMD Athalon 1.8Ghz machine + 2Gb of ram. After the automatic upgrade, I started to notice that some mail coming into my Exchange server was delayed by up to 12 hours. The CPU of the Untangle machine never went above 30% but from reading around the forums, I thought that it might be worth upgrading to a more powerful server to see if the extra HP would make a difference.

I installed a new machine last Friday from a 6.1 ISO with no problems on a HP DL380 dual core Xeon 3Ghz + 3Gb Ram. I performed a backup and restore to the new server, swapped all my cables over and it started working perfectly. The server worked all Friday afternoon and I thought I had cracked the problem but Monday morning came and the new server was displaying the same simptoms as the old server. CPU at 30% and the logs were showing that most of the mail was receiving a SPAM score of 0 and being blocked.

Since then, I have changed the default SPAM response from reject to accept so at least we are not missing any important mails but obviously my Exchange server is not doing a very good job at filtering the SPAMS so we are recieving a lot of junk.

I have around 20 users on my network and to give you an idea of scale, the new server has processed around 25,000 emails in the past 24 hours.

Thanks

[far182]

Hi,

I have around 20 users on my network and to give you an idea of scale, the new server has processed around 25,000 emails in the past 24 hours.

Thanks

Looks like you are having a spam attack. That's a lot of Spam for 20 people.

[pauljones_2]

It is but it has always been around that level really.

[dmorris]

check /var/log/syslog and /var/log/uvm/#.log where # is the node id of spamassassin when you run 'ucli instances'

welcome to the forums

[JEllingson]

A common theme I'm seeing lately is that "restores" to 6.1 seem to result in something going wonky with the SpamBlocker module.

If you can (and this is what I did), install from scratch the ISO and then manually configure everything.

- Jason

[dmorris]

A common theme I'm seeing lately is that "restores" to 6.1 seem to result in something going wonky with the SpamBlocker module.

If you can (and this is what I did), install from scratch the ISO and then manually configure everything.

- Jason

yeah, i've noticed the same thing - i wonder whats going on with that...

[pauljones_2]

I just reinstalled my server with 6.1 and entered the config from scratch......so far so good.

Thanks for your help with this.

[sky-knight]

Can you get away with removing the spamblocker and just installing that module?

[pauljones_2]

I monitored UT for a while last night and everything apeared to be working fine. It looked like the SPAM module was working correctly and no emails were given a score of 0.

Unfortunately, I have just checked the box again 12 hours later and the vast majority of mails are being scored at 0 and being rejected. The CPU is back up to 30-40%.

Any more idea's?

[PCS]

I am having the same problem. Was running under VMWARE but changed to a clean install on the machine (Pentium D 2.8GHz) and upgraded to 2GB. Has been working for about 3 weeks and now I am getting the Spam score of 0 again. I have had my domain a long time and get hammered by spammers. My last weekly report:
Scanned emails (SMTP) 2.676 M
Spam connection rejected using DNSBLs 2.529 M 94.62%
Spam & Quarantined 383 0.01%
Spam & Blocked 119,437 4.28%
Spam & Marked 18,556 0.67%
Clean & Passed 11,815 0.42%
Scanned emails (POP/IMAP) 3
Clean & Passed 3 100.00%

CPU never gets above 35 -40% and hovers around 15%. It seems a lot of people are having this issue if you search the forums. As suggested in another thread, I cleared the Spamassassin database with no effect.

Not sure where to go from here. Maybe 6.2 upgrade will fix it.