Mailing List Archive

On Thu, Feb 26, 2004 at 02:53:02PM +0100, Giannici Federico wrote:
> Is a problem on my system (but I changed nothing since yesterday) or is
> there some problem with Razor2?

I shutoff Razor after it got down to < 30% hitrate.

--
Randomly Generated Tagline:
Lispers are among the best grads of the Sweep-It-Under-Someone-Else's-Carpet
School of Simulated Simplicity. [Was that sufficiently incendiary? :-)]
-- Larry Wall in <1992Jan10.201804.11926@netlabs.com

Theo Van Dinter wrote:

>>Is a problem on my system (but I changed nothing since yesterday) or is
>>there some problem with Razor2?
>
>
> I shutoff Razor after it got down to < 30% hitrate.

That leads to a question, what alternatives to Razor and DCC are there?
Specifically ones that are successful?

-- Steve

On Thu, Feb 26, 2004 at 02:16:02PM -0500, Lists wrote:
> That leads to a question, what alternatives to Razor and DCC are there?
> Specifically ones that are successful?

Well, for the ones SA supports, there's Pyzor. I personally don't use it
since, at last check, it's basically Razor v1 which had lots of issues.
I'm sure someone'll correct me if I'm wrong about it.

DCC is getting >70% hitrate for me, and Razor v2 is < 30%.

There's been some talk about other collaborative spam database systems,
as well as some other 100% closed ones (Brightmail for instance), but
I don't think any of the non-closed ones have really become available yet.

--
Randomly Generated Tagline:
"... but I got high score on terminator." - Prof. O'Donnell

At 11:16 AM 2/26/2004, Lists wrote:
>That leads to a question, what alternatives to Razor and DCC are
>there? Specifically ones that are successful?

Well, there's Pyzor. Not a super-high hit rate, but it's at least working
today. Plus you can use a local database if you want, instead of relying
on the central Razor/Cloudmark server.

Other than that... ?


Kelson Vibber
SpeedGate Communications <www.speed.net>

At 11:27 AM 2/26/2004, I wrote:
>Well, there's Pyzor. Not a super-high hit rate, but it's at least working
>today. Plus you can use a local database if you want, instead of relying
>on the central Razor/Cloudmark server.

I just realized that could be misinterpreted. To clarify:

Pyzor does NOT use Razor's server. It's a similar implementation, but they
use their own hashing and their own database. The point I intended to make
is that unlike Razor, if the central Pyzor server vanishes, you can always
run your own.


Kelson Vibber
SpeedGate Communications <www.speed.net>

re: Razor2

There were a few posts in recent days re: Razor being unavailable. We have
not seen any Razor or Pyzor checks completed for several days.

Has something changed or have I broken something here?

Bruce C

Feb 27 12:33:54 spamd[18500]: debug: razor2 check could not connect to any
servers
Feb 27 12:33:54 spamd[18500]: debug: leaving helper-app run mode
Feb 27 12:33:54 spamd[18500]: debug: Razor2 results: spam? 0 highest cf
score: 0
Feb 27 12:33:54 spamd[18500]: debug: Razor2 is available
Feb 27 12:33:54 spamd[18500]: debug: Pyzor is available: /usr/bin/pyzor
Feb 27 12:33:54 spamd[18500]: debug: entering helper-app run mode
Feb 27 12:33:54 spamd[18500]: debug: Pyzor: got response: Traceback (most
recent call last):
Feb 27 12:33:54 spamd[18500]: debug: leaving helper-app run mode
Feb 27 12:33:54 spamd[18500]: debug: Pyzor: couldn't grok response
"Traceback (most recent call last):"

At 09:51 AM 2/27/2004, Bruce Cornett wrote:
>There were a few posts in recent days re: Razor being unavailable. We
>have not seen any Razor or Pyzor checks completed for several days.

A note was posted to the Razor mailing list that some of Razor's servers
went down under heavy load. Two servers have been added, and at least some
people have been seeing Razor working again. You may need to run
"razor-admin --discover" as your spamd user in order to pick up the new
servers.

As for Pyzor, I haven't seen any problems with it here. It's completely
separate from Razor, so it won't be affected by Razor's downtime, but
because it's a similar model, it's vulnerable to the same problems (i.e.
spikes in world mail traffic can lead to spikes in queries to their
servers, which can overload the services). "pyzor discover" may help here
as well.


Kelson Vibber
SpeedGate Communications <www.speed.net>

On Thu, 26 Feb 2004 14:03:39 -0500, Theo Van Dinter wrote:

> I shutoff Razor after it got down to < 30% hitrate.

Here we use Razor, DCC and Pyzor. Some numbers from today:

Stats for all incoming mail that was checked by SA:
spam-score>=8: 40%.
hit Razor rule: 11%
hit Pyzor rule: 13%
hit DCC rule: 14%
hit Razor, DCC or Pyzor rules (s): 22%
hit all three: 5%

Stats for incoming mail with spam-score>=8:
hit Razor rule: 28%
hit Pyzor rule: 33%
hit DCC rule: 36%
hit Razor, DCC or Pyzor rule(s): 55%.
hit all three: 13%.


Personally I think the combined number of hits these checks makes them quite worthwhile to use. OTH we don't get a high volume of mail so we can afford to use a bunch of network tests.

Of course, DCC is something rather different from Razor and Pyzor so it doesn't really fit in the stats above.

Regards
/Jonas
--
Jonas Eckerman, jonas_lists@frukt.org
http://www.fsdb.org/