[TriLUG] email content filtering

[William Ward]

Jon,

I looked at the SpamAssassin website and found some of the technical 
detail you may be referring to.  Sounds like the sort of thing we need 
to try out at my company, hopefully before Brightmail appears and sucks 
up some more capital/expense.

Two questions:
1.  You mention a mail scanner list.  Where could I find archives for 
this list, if you don't mind?  I'd like to read through them and see 
how much trouble I can get into creating a test box.
2.  You also mentioned a solution for virus scanning?  Is this a Linux 
open source product, or a commercial product for Linux?  We're also 
using Trend VirusWall for our malicious code filtering, and its a 
headache to administer.

To the rest of the list:
I think it'd be great to hear what some of you other mail admins have 
done to implement spam/virus filters in your mail handlers to prevent 
the end-user folks from popping open each attachment that slides down 
the pipe.  My goal is to see what open source/free software solutions I 
can use to replace costly and unreliable commercial solutions we 
currently use.  In the process maybe I can cut back on the amount of 
pointless overhead one of my poor admin peers has to do on a daily 
basis.

Thanks,
Bill


On Sunday, September 1, 2002, at 05:34 PM, Jon Carnes wrote:

> I ran SpamAssassin as a daemon on an older PC (650Mhz, 768Mb RAM) and 
> it
> easily handled 8,000 emails/day.  I estimate that if we raised the RAM
> to a full 1Gb then the box could easily have handled three times that
> amount of mail. There were around 180 individual accounts, and probably
> 500 corporate alias/group accounts.
>
> Folks on the Mail Scanner list report scanning up-wards of 250,000
> emails/day on their systems, and in this case they are scanning both 
> for
> viruses and for spam.
>
> If you overload a system that is running SpamAssassin by throwing too
> much mail at it, then the mail will simply queue up. Normal latency 
> (for
> the system I set up at my former employer) added an average of 5 
> seconds
> to incoming email.  Of course you only test incoming email... The peak
> latency was around 25 minutes - with the peak occurring late at night.
>
> SpamAssassin is really quite amazing.  We've talked about it on this
> list before, so I won't repeat the details again, but if you want more
> info, drop me line and I'll be happy to describe how it works in detail
> for you.