[opensuse] Spamassassin w/kmail eating 50% of CPU, howto renice?

David C. Rankin

11 Aug 2009 11 Aug '09

15:38

Listmates, In kde 4.3, when kmail starts and has several hundred messages to download, spamassassin goes nuts and eats 50% of the CPU until it has finished scanning all of the new messages, this can take 15-30 minutes. During this time, the whole system is running very slowly (you type and wait for the characters to appear). How can I set the priority for spamassassin so it never takes more than say 10% of the CPU -- or -- tell it to only work when I'm not doing anything else? I'm not that concerned with email viruses anyway (I'm not stupid enough to click on attachments in a willy-nilly fashion), so uninstalling spamassassin is an option as well, but if I can fix it, I'd rather keep it. What's the best way to deal with this issue? Here are a couple of screenshots showing the effect of spamassassin on CPU usage. (It takes close to 100% of 1 core or 50% of the total). This box normally idles at 4% CPU utilization during normal use and browsing, word processing, etc. stays well within 15%. http://www.3111skyline.com/download/openSUSE_bugs/kde4/screenshots/spamassas... http://www.3111skyline.com/download/openSUSE_bugs/kde4/screenshots/spamassas... -- David C. Rankin, J.D.,P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Show replies by date

Per Jessen

11 Aug 11 Aug

15:53

David C. Rankin wrote:

...

Listmates,

In kde 4.3, when kmail starts and has several hundred messages to download, spamassassin goes nuts and eats 50% of the CPU until it has finished scanning all of the new messages, this can take 15-30 minutes. During this time, the whole system is running very slowly (you type and wait for the characters to appear). How can I set the priority for spamassassin so it never takes more than say 10% of the CPU -- or -- tell it to only work when I'm not doing anything else?

To the latter - nice 19.

...

I'm not that concerned with email viruses anyway (I'm not stupid enough to click on attachments in a willy-nilly fashion), so uninstalling spamassassin is an option as well, but if I can fix it, I'd rather keep it. What's the best way to deal with this issue?

Spamassassin is more about spam than virus - clamav is for virus. But if you don't want/need it, yes, why not just remove it. /Per -- Per Jessen, Zürich (23.1°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Per Jessen

15:58

Per Jessen wrote:

...

David C. Rankin wrote:

...
Listmates,

In kde 4.3, when kmail starts and has several hundred messages to download, spamassassin goes nuts and eats 50% of the CPU until it has finished scanning all of the new messages, this can take 15-30 minutes. During this time, the whole system is running very slowly (you type and wait for the characters to appear). How can I set the priority for spamassassin so it never takes more than say 10% of the CPU -- or -- tell it to only work when I'm not doing anything else?

To the latter - nice 19.

uh, that assumes you're running spamassassin as a daemon, spamd for instance. If you're running it via procmail, I guess you could modify your procmail recipe to nice it. /Per -- Per Jessen, Zürich (22.9°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Patrick Shanahan

16:28

* Per Jessen [08-11-09 11:59]:

...

uh, that assumes you're running spamassassin as a daemon, spamd for instance. If you're running it via procmail, I guess you could modify your procmail recipe to nice it.

Not necessary, Note: running spamd ***** <begin> #VERBOSE=on # ------------------------------------------------------- # SpamAssassin for procmailrc # # Pipe the mail through spamassassin (replace 'spamassassin' with 'spamc' # if you use the spamc/spamd combination) # # The condition line ensures that only messages smaller than 250 kB # (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam # isn't bigger than a few k and working with big messages can bring # SpamAssassin to its knees. # # The lock file ensures that only 1 spamassassin invocation happens # at 1 time, to keep the load down. # note: lock file *only* necessary for mbox mail storage # :0fw: spamassassin.lock * < 256000 #| $SPAMASSASSIN | $SPAMC # Mails with a score of 15 (9) or higher are almost certainly spam (with 0.05% # false positives according to rules/STATISTICS.txt). Let's put them in a # different mbox. (This one is optional.) #:0: #* ^X-Spam-Level: \*\*\*\*\*\*\*\*\* #$MAILDIR/almost-certainly-spam # All mail tagged as spam (eg. with a score higher than the set threshold) # is moved to "probably-spam". :0: #* ^X-Spam-Status: Yes * ^X-Spam-Flag: YES $MAILDIR/probably-spam # ------------------------------------------------------- VERBOSE=off </begin> -- Patrick Shanahan Plainfield, Indiana, USA HOG # US1244711 http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://counter.li.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Per Jessen

17:14

Patrick Shanahan wrote:

...

* Per Jessen [08-11-09 11:59]:

...
uh, that assumes you're running spamassassin as a daemon, spamd for instance. If you're running it via procmail, I guess you could modify your procmail recipe to nice it.

Not necessary,

Note: running spamd *****

Which says it all :-) /Per -- Per Jessen, Zürich (22.4°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

17:35

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday, 2009-08-11 at 17:58 +0200, Per Jessen wrote:

...

...
To the latter - nice 19.

uh, that assumes you're running spamassassin as a daemon, spamd for instance. If you're running it via procmail, I guess you could modify your procmail recipe to nice it.

If it runs via procmail, first modify procmail to use spamc instead, and then start the daemon, niced. It is also possible to run several scans simultaneously. spamassassin is very cpu intensive, and it only scans for spam. Amavis new does spam checking (without the bayes part, I think) and virus checking (via an external antivirus, which can also be very slow). - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkqBq+oACgkQtTMYHG2NR9XA0gCdHHogJDyz5Pbd9ZtA8F36XZjK dFoAoIghgf5gyLRpGesaFJYQKkSH32pC =fnzB -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Per Jessen

17:38

Carlos E. R. wrote:

...

spamassassin is very cpu intensive, and it only scans for spam. Amavis new does spam checking (without the bayes part, I think) and virus checking (via an external antivirus, which can also be very slow).

clamav is very fast - I think only a few milliseconds per email. /Per -- Per Jessen, Zürich (22.6°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

19:54

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday, 2009-08-11 at 19:38 +0200, Per Jessen wrote:

...

Carlos E. R. wrote:

...
spamassassin is very cpu intensive, and it only scans for spam. Amavis new does spam checking (without the bayes part, I think) and virus checking (via an external antivirus, which can also be very slow).

clamav is very fast - I think only a few milliseconds per email.

You must have a fast machine. It is somewhat slow here, and doesn't catch all viruses. Antivir catches more, but this one is very slow. The problem is that amavis-new feeds every email through the antivirus, even if it is plain text - unless things have changed since last time I checked. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkqBzI0ACgkQtTMYHG2NR9WLSgCeOz5A5uYtgIawrzYKETSQL+iO tZkAoIwvDl/kv69h4EXe9fYG7im28wTI =1zKW -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Per Jessen

12 Aug 12 Aug

07:39

Carlos E. R. wrote:

...

On Tuesday, 2009-08-11 at 19:38 +0200, Per Jessen wrote:

...
Carlos E. R. wrote:

...
spamassassin is very cpu intensive, and it only scans for spam. Amavis new does spam checking (without the bayes part, I think) and virus checking (via an external antivirus, which can also be very slow).

clamav is very fast - I think only a few milliseconds per email.

You must have a fast machine.

Nothing unusual - my test-system runs on PII 400MHz machines. I took a look at yesterdays log: Ignoring everything with scan times <10milliseconds, I had 8852 scans done, maximum time 3.52second, minimum 10milliseconds. Average scan time 150milliseconds. Scan times: <50ms - 44% 50ms-100ms - 25% 100-500ms - 21% So maybe not exactly "a few milliseconds", but 69% done in less than 100ms.

...

It is somewhat slow here, and doesn't catch all viruses. Antivir catches more, but this one is very slow.

Do you actually have examples of virus that were not caught by clamav? (not just from somebodys test or report, a real example). I've been using clamav for 3-4 years, and I have not yet seen a virus that wasn't caught.

...

The problem is that amavis-new feeds every email through the antivirus, even if it is plain text - unless things have changed since last time I checked.

Given the time it takes to pass something through clamav, it's faster than trying to identify the contents first. /Per -- Per Jessen, Zürich (19.8°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

13:32

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday, 2009-08-12 at 09:39 +0200, Per Jessen wrote:

...

...
...
clamav is very fast - I think only a few milliseconds per email.

You must have a fast machine.

Nothing unusual - my test-system runs on PII 400MHz machines. I took a look at yesterdays log:

Ignoring everything with scan times <10milliseconds, I had 8852 scans done, maximum time 3.52second, minimum 10milliseconds. Average scan time 150milliseconds.

Scan times:

<50ms - 44% 50ms-100ms - 25% 100-500ms - 21%

So maybe not exactly "a few milliseconds", but 69% done in less than 100ms.

My machine is a P-IV. It takes more than milliseconds: cer@nimrodel:~/viruses> ls -l ; time clamscan * total 632 - -rw-r--r-- 1 cer users 52521 2005-10-07 02:52 Worm_Gibe_C_1.zip - -rw------- 1 cer users 88573 2005-10-07 02:52 href.pif - -rw------- 1 cer users 92755 2005-10-07 02:52 nuevapromo[1].bat lrwxrwxrwx 1 root root 17 2007-02-05 02:31 nuevapromo_1_.bat -> nuevapromo[1].bat - -rw-r--r-- 1 cer users 90438 2005-10-07 02:52 pagina.bat - -rw-r--r-- 1 cer users 294912 2005-10-07 02:52 sample.exe-virus_W32-Nimd Worm_Gibe_C_1.zip: Worm.Gibe.F FOUND href.pif: W32.Elkern.C FOUND nuevapromo[1].bat: W32.Elkern.C FOUND nuevapromo_1_.bat: W32.Elkern.C FOUND pagina.bat: W32.Elkern.C FOUND sample.exe-virus_W32-Nimd: Worm.Nimda.e FOUND - ----------- SCAN SUMMARY ----------- Known viruses: 608499 Engine version: 0.95.2 Scanned directories: 0 Scanned files: 6 Infected files: 6 Data scanned: 0.57 MB Data read: 0.67 MB (ratio 0.85:1) Time: 4.873 sec (0 m 4 s) real 0m4.888s <==================== user 0m3.732s sys 0m0.452s cer@nimrodel:~/viruses> cer@nimrodel:~/viruses> time antivir * AntiVir / Linux Version 2.1.12-180 Copyright (c) 2008 by Avira GmbH. All rights reserved. Warning: The file "antivir.vdf" is more than 14 days old. VDF version: 7.1.4.252 created 17 Jul 2009 For private, non-commercial use only. AntiVir license: 149996 for Avira AntiVir PersonalEdition Classic auto excluding /sys/ from scans (is a special fs) auto excluding /proc from scans (is a special fs) auto excluding /var/lib/ntp/proc from scans (is a special fs) sample.exe-virus_W32-Nimd Date: 07.10.2005 Time: 02:52:22 Size: 294912 ALERT: [W32/Nimda.html] sample.exe-virus_W32-Nimd <<< Contains detection pattern of the Windows virus W32/Nimda.html pagina.bat Date: 07.10.2005 Time: 02:52:22 Size: 90438 ALERT: [W32/Elkern.C] pagina.bat <<< Contains detection pattern of the Windows virus W32/Elkern.C nuevapromo_1_.bat Date: 07.10.2005 Time: 02:52:22 Size: 92755 ALERT: [W32/Elkern.C] nuevapromo_1_.bat <<< Contains detection pattern of the Windows virus W32/Elkern.C nuevapromo[1].bat Date: 07.10.2005 Time: 02:52:22 Size: 92755 ALERT: [W32/Elkern.C] nuevapromo[1].bat <<< Contains detection pattern of the Windows virus W32/Elkern.C href.pif Date: 07.10.2005 Time: 02:52:22 Size: 88573 ALERT: [W32/Elkern.C] href.pif <<< Contains detection pattern of the Windows virus W32/Elkern.C - ------ scan results ------ directories: 0 scanned files: 6 alerts: 5 suspicious: 0 repaired: 0 deleted: 0 renamed: 0 quarantined: 0 scan time: 00:00:01 - -------------------------- Thank you for using AntiVir. real 0m7.932s <==================== user 0m5.588s sys 0m0.960s cer@nimrodel:~/viruses>

...

...
It is somewhat slow here, and doesn't catch all viruses. Antivir catches more, but this one is very slow.

Do you actually have examples of virus that were not caught by clamav? (not just from somebodys test or report, a real example). I've been using clamav for 3-4 years, and I have not yet seen a virus that wasn't caught.

Yes, I have. cer@nimrodel:~/tmp/p> l ; time clamscan DC0050.jpg__________________________________________________________________________________________.exe total 40 drwxr-xr-x 2 cer users 117 2009-07-18 00:47 ./ drwxr-xr-x 29 cer users 4096 2009-07-06 10:38 ../ - -rw-r--r-- 1 cer users 32256 2009-07-15 14:48 DC0050.jpg__________________________________________________________________________________________.exe DC0050.jpg__________________________________________________________________________________________.exe: OK - ----------- SCAN SUMMARY ----------- Known viruses: 608499 Engine version: 0.95.2 Scanned directories: 0 Scanned files: 1 Infected files: 0 <================================ Data scanned: 0.03 MB Data read: 0.03 MB (ratio 1.00:1) Time: 4.539 sec (0 m 4 s) real 0m4.547s user 0m3.432s sys 0m0.532s cer@nimrodel:~/tmp/p> time antivir DC0050.jpg__________________________________________________________________________________________.exe AntiVir / Linux Version 2.1.12-180 Copyright (c) 2008 by Avira GmbH. All rights reserved. Warning: The file "antivir.vdf" is more than 14 days old. VDF version: 7.1.4.252 created 17 Jul 2009 For private, non-commercial use only. AntiVir license: 149996 for Avira AntiVir PersonalEdition Classic auto excluding /sys/ from scans (is a special fs) auto excluding /proc from scans (is a special fs) auto excluding /var/lib/ntp/proc from scans (is a special fs) DC0050.jpg__________________________________________________________________________________________.exe Date: 15.07.2009 Time: 14:48:00 Size: 32256 ALERT: [TR/Crypt.XPACK.Gen] DC0050.jpg__________________________________________________________________________________________.exe <<< Is the Trojan horse TR/Crypt.XPACK.Gen - ------ scan results ------ directories: 0 scanned files: 1 alerts: 1 suspicious: 0 repaired: 0 deleted: 0 renamed: 0 quarantined: 0 scan time: 00:00:01 - ------------------------ Thank you for using AntiVir. real 0m7.359s user 0m5.592s sys 0m0.884s cer@nimrodel:~/tmp/p> See? :-)

...

...
The problem is that amavis-new feeds every email through the antivirus, even if it is plain text - unless things have changed since last time I checked.

Given the time it takes to pass something through clamav, it's faster than trying to identify the contents first.

Yes, but amavis does identify the files anyway. One of the possible filters is to reject any executable content, even if it goes inside of an encripted zip (I tried this, not hearsay ;-) ) - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkqCxI0ACgkQtTMYHG2NR9UlKgCfR7P/k1KP2kwNnr6rUOFKY5Q/ CdMAnAxhVSzvXsjAw2m+pphemgMXptpl =m6Mk -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Per Jessen

13:48

Carlos E. R. wrote:

...

My machine is a P-IV. It takes more than milliseconds:

cer@nimrodel:~/viruses> ls -l ; time clamscan *

Well yeah. That's a very different task - comparing that to scanning a single email make little sense. /Per -- Per Jessen, Zürich (24.5°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

14:46

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday, 2009-08-12 at 15:48 +0200, Per Jessen wrote:

...

Carlos E. R. wrote:

...
My machine is a P-IV. It takes more than milliseconds:

cer@nimrodel:~/viruses> ls -l ; time clamscan *

Well yeah. That's a very different task - comparing that to scanning a single email make little sense.

You are difficult to convince... ok, look: Apr 9 13:26:15 nimrodel amavis[15716]: (15716-16) Blocked INFECTED (Worm.Nimda.e), -> , quarantine: virus-tUVBodzmeu6A, Message-ID: <20090409112612.93EF2D2658@nimrodel.valinor>, mail_id: tUVBodzmeu6A, Hits: - -, size: 405149, 3038 ms See? Three seconds to scan (when typical time to scan a plain text email is half a second) To be exact, I would have to reconfigure amavis-new not to scan for virus, feed a sample email, then repeat reconfiguring for virus scan, and repeat the send. Considering for a large overhead, taking out, say, 1.5 seconds, would still leave a full second for clamav... not milliseconds. And you haven't commented on the sample test I showed of clamav not detecting a virus that antivir did detect. A trojan, actually. >:-) - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkqC1doACgkQtTMYHG2NR9U8VgCgi+MkOnA5iY+/0NYoFu4aknU1 pmAAnRIGr9OABSoFeoW0G4PSsUkFQb10 =t6DS -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Per Jessen

15:47

Carlos E. R. wrote:

...

On Wednesday, 2009-08-12 at 15:48 +0200, Per Jessen wrote:

...
Carlos E. R. wrote:

...
My machine is a P-IV. It takes more than milliseconds:

cer@nimrodel:~/viruses> ls -l ; time clamscan *

Well yeah. That's a very different task - comparing that to scanning a single email make little sense.

You are difficult to convince... ok, look:

Apr 9 13:26:15 nimrodel amavis[15716]: (15716-16) Blocked INFECTED (Worm.Nimda.e), -> , quarantine: virus-tUVBodzmeu6A, Message-ID: <20090409112612.93EF2D2658@nimrodel.valinor>, mail_id: tUVBodzmeu6A, Hits: - -, size: 405149, 3038 ms

See? Three seconds to scan (when typical time to scan a plain text email is half a second)

Okay, I had one of those too - yet the vast majority was processed in less than 100 milliseconds. On an ancient 400MHz machine, that is pretty good. Your 3038ms example is perhaps just the exception to prove the rule.

...

To be exact, I would have to reconfigure amavis-new not to scan for virus, feed a sample email, then repeat reconfiguring for virus scan, and repeat the send. Considering for a large overhead, taking out, say, 1.5 seconds, would still leave a full second for clamav... not milliseconds.

Carlos, you can't keep running on 486's - you must be way due for an upgrade :-) I think perhaps it is your amavis-thingie that is slow, not clamav?

...

And you haven't commented on the sample test I showed of clamav not detecting a virus that antivir did detect. A trojan, actually. >:-)

Sorry, I didn't get that far. Can you send me that file off-line, please? I'm very surprised that clamav didn't catch it. Don't bother encrypting it, just send normally, then we'll see if my test system catches it or not. /Per -- Per Jessen, Zürich (25.9°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

19:26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday, 2009-08-12 at 17:47 +0200, Per Jessen wrote:

...

...
...
...
cer@nimrodel:~/viruses> ls -l ; time clamscan *

Well yeah. That's a very different task - comparing that to scanning a single email make little sense.

You are difficult to convince... ok, look:

Apr 9 13:26:15 nimrodel amavis[15716]: (15716-16) Blocked INFECTED (Worm.Nimda.e), -> , quarantine: virus-tUVBodzmeu6A, Message-ID: <20090409112612.93EF2D2658@nimrodel.valinor>, mail_id: tUVBodzmeu6A, Hits: - -, size: 405149, 3038 ms

See? Three seconds to scan (when typical time to scan a plain text email is half a second)

Okay, I had one of those too - yet the vast majority was processed in less than 100 milliseconds. On an ancient 400MHz machine, that is pretty good. Your 3038ms example is perhaps just the exception to prove the rule.

I get very few viruses, I had to search months back in my logs to find one. But when I enabled virus scan in amavis time ago (2-3 yr back), I had to disable it because it (viruscan) was so slow... I think back then amavis scanned all mails, now it only scans executables. I'm not sure of this.

...

...
To be exact, I would have to reconfigure amavis-new not to scan for virus, feed a sample email, then repeat reconfiguring for virus scan, and repeat the send. Considering for a large overhead, taking out, say, 1.5 seconds, would still leave a full second for clamav... not milliseconds.

Carlos, you can't keep running on 486's - you must be way due for an upgrade :-)

It is a Pentium IV ;-) But yes, I'm in the upgrade process.

...

I think perhaps it is your amavis-thingie that is slow, not clamav?

Both :-p

...

...
And you haven't commented on the sample test I showed of clamav not detecting a virus that antivir did detect. A trojan, actually. >:-)

Sorry, I didn't get that far. Can you send me that file off-line, please? I'm very surprised that clamav didn't catch it. Don't bother encrypting it, just send normally, then we'll see if my test system catches it or not.

Ok, will do. Provided that my amavis lets me... [...] I think it passed. "Passed BANNED ... 1373 ms", it said. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkqDF0sACgkQtTMYHG2NR9VYgQCfVuk4Nnwitk2V2kiKehcUZIZ5 aBwAoIjuPXuDzQXQ5w5ESStgzUrhzbgA =a0oi -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Per Jessen

19:45

Carlos E. R. wrote:

...

...
...
And you haven't commented on the sample test I showed of clamav not detecting a virus that antivir did detect. A trojan, actually. >:-)

Sorry, I didn't get that far. Can you send me that file off-line, please? I'm very surprised that clamav didn't catch it. Don't bother encrypting it, just send normally, then we'll see if my test system catches it or not.

Ok, will do. Provided that my amavis lets me... [...] I think it passed. "Passed BANNED ... 1373 ms", it said.

For those following this thread - clamav did indeed NOT catch it. I am a little backlevel due to an API problem, but this trojan is about two years old, so that should not be a problem. /Per -- Per Jessen, Zürich (21.2°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

20:13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday, 2009-08-12 at 21:45 +0200, Per Jessen wrote:

...

Carlos E. R. wrote:

...

...
I think it passed. "Passed BANNED ... 1373 ms", it said.

For those following this thread - clamav did indeed NOT catch it. I am a little backlevel due to an API problem, but this trojan is about two years old, so that should not be a problem.

2 yr? Wow. I've reported some viruses to clamav and/or antivir, but not this one, I'm afraid. It takes some time to do so... Anyway, it is a sad fact that not a single antivirus detects all malware, so those that depend on these tools have to use several. Or, you can configure amavis to catch and block any executable, be it virus or bonafide. This strategy is safer and faster to execute, unless someone really needs to send/receive executables. Dunno about .doc macros, though :-? - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEUEARECAAYFAkqDIo4ACgkQtTMYHG2NR9UdQACY+irMG7h+3QO4l5Thw3A0kkoA EgCgkTpfNegaaRLLlOehMVXo5zkyAY4= =BTjJ -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Heinz Diehl

11 Aug 11 Aug

17:52

At Tue, 11 Aug 2009 19:35:31 +0200 (CEST), Carlos E. R. wrote:

...

spamassassin is very cpu intensive

SA is a major drag. Period. I haven't used it a long time, and I'm quite shure I'll never use it again. This little tool here runs like hell, and I am fully satisfied with it since years: http://www.fourmilab.ch/annoyance-filter/ It outperforms SA by at least factor 100. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

19:56

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday, 2009-08-11 at 19:52 +0200, Heinz Diehl wrote:

...

...
spamassassin is very cpu intensive

SA is a major drag. Period. I haven't used it a long time, and I'm quite shure I'll never use it again. This little tool here runs like hell, and I am fully satisfied with it since years:

http://www.fourmilab.ch/annoyance-filter/

It outperforms SA by at least factor 100.

Is it free, in both senses? As in freedom and as in beer? - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkqBzOgACgkQtTMYHG2NR9XL/wCcCpgXMPnfE3FwjvKCAm7shNeM CPIAoJKTMGBTC55PL8dQDnHD0MWbbZFM =DyrP -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Heinz Diehl

20:07

New subject: [opensuse] Re: Spamassassin w/kmail eating 50% of CPU, howto renice?

On 11.08.2009, Carlos E. R. wrote:

...

Is it free, in both senses? As in freedom and as in beer?

This is what you can find at its webpage: Distribution This software is in the public domain. Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, without any conditions or restrictions. This software is provided "as is" without express or implied warranty. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Boyd Stephen Smith Jr.

20:12

In , Carlos E. R. wrote:

...

On Tuesday, 2009-08-11 at 19:52 +0200, Heinz Diehl wrote:

...
http://www.fourmilab.ch/annoyance-filter/

It outperforms SA by at least factor 100.

Is it free, in both senses? As in freedom and as in beer?

The manpage says: This software is in the public domain. Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, without any conditions or restrictions. This software is provided ``as is'' without express or implied warranty. So, yes. -- Boyd Stephen Smith Jr. ,= ,-_-. =. bss@iguanasuicide.net ((_/)o o(\_)) ICQ: 514984 YM/AIM: DaTwinkDaddy `-'(. .)`-' http://iguanasuicide.net/ \_/

Heinz Diehl

20:35

At Tue, 11 Aug 2009 15:12:11 -0500, Boyd Stephen Smith Jr. wrote:

...

So, yes.

Yes, both the source and use is free. I personally invoke it from my .procmailrc. It's important that you only teach the program what's wrong (=the false positives/negatives). It learns extremely fast and the failure ratio is close to zero. It should be no problem at all to call it via postfix or any other real MTA. However, you'll have to write some scripts to make living easier. If someone is interested, I can provide mine. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

21:51

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday, 2009-08-11 at 22:35 +0200, Heinz Diehl wrote:

...

Yes, both the source and use is free.

I personally invoke it from my .procmailrc. It's important that you only teach the program what's wrong (=the false positives/negatives). It learns extremely fast and the failure ratio is close to zero.

I also get a ratio very close to zero with SA, after training the bayesian filter.

...

It should be no problem at all to call it via postfix or any other real MTA. However, you'll have to write some scripts to make living easier. If someone is interested, I can provide mine.

I'll wait till it gets integrated with the distribution. If. :-) - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkqB5/0ACgkQtTMYHG2NR9VGzACfYVnyTQvGI51styVfFeDdO6Jx 104Ani+Mk1zcaKIB5FaT4zz+ECmBXfBz =T59r -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Per Jessen

12 Aug 12 Aug

07:54

Carlos E. R. wrote:

...

On Tuesday, 2009-08-11 at 22:35 +0200, Heinz Diehl wrote:

...
Yes, both the source and use is free.

I personally invoke it from my .procmailrc. It's important that you only teach the program what's wrong (=the false positives/negatives). It learns extremely fast and the failure ratio is close to zero.

I also get a ratio very close to zero with SA, after training the bayesian filter.

CRM114 is also an excellent bayesian (and more) style filter. Very flexible and for more than just spam-recognition. /Per -- Per Jessen, Zürich (20.3°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

David Haller

13 Aug 13 Aug

18:06

Hello, On Wed, 12 Aug 2009, Per Jessen wrote:

...

Carlos E. R. wrote:

...
On Tuesday, 2009-08-11 at 22:35 +0200, Heinz Diehl wrote:

...
Yes, both the source and use is free.

I personally invoke it from my .procmailrc. It's important that you only teach the program what's wrong (=the false positives/negatives). It learns extremely fast and the failure ratio is close to zero.

I also get a ratio very close to zero with SA, after training the bayesian filter.

CRM114 is also an excellent bayesian (and more) style filter. Very flexible and for more than just spam-recognition.

I use bogofilter, dspam and spamassassin, in that order ;) -dnh -- "I have a very firm grasp on reality! I can reach out and strangle it any time!" -- from the BSD fortune file -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Linda Walsh

20 Aug 20 Aug

06:45

New subject: [opensuse] Re: Spamassassin w/kmail eating 50% of CPU, howto renice?

David C. Rankin wrote:

...

Listmates,

In kde 4.3, when kmail starts and has several hundred messages to download, spamassassin goes nuts and eats 50% of the CPU until it has finished scanning all of the new messages, this can take 15-30 minutes. During this time, the whole system is running very slowly (you type and wait for the characters to appear). How can I set the priority for spamassassin so it never takes more than say 10% of the CPU -- or -- tell it to only work when I'm not doing anything else?

When kmail starts? Where is your email? Why do you regularly have backlogs of several hundred messages to download? spamassassin is normally meant to be run as a daemon on email in the background __as email comes in__... You don't want to usually run it when you login to read email. It sorta _sounds_ like you are using maybe a laptop? and only log into your provider once a day? Maybe you could forward it all to a google account and let google do the spam filtering (they do a pretty good job once you setup their system). Then you could download your cleaned email from google and not spend your time waiting on the computer -- either that, or get a computer you can leaved plugged into the internet to download and spool your cleaned email, then when you attach your notebook, your mail-spool 'puter will have already run spamd on everything as it comes in -- and you can just download the presorted results (including the spam if you want to sort through stuff to search for mistakes). Just some thoughts... -linda -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

5371

Age (days ago)

5380

Last active (days ago)

List overview

Download

24 comments

8 participants

participants (8)

Boyd Stephen Smith Jr.
Carlos E. R.
David C. Rankin
David Haller
Heinz Diehl
Linda Walsh
Patrick Shanahan
Per Jessen