Desperado,

 I remember your mentioning you use multiple copies of SF. How do you synch up autowhitelistdelivery.txt files (assuming you have 2 boxes doing MX for your domains).

SF works great for us now but if we were to double or triple our size the current anti-spam solution would need to be re-evaluated.

Things I think could become a concern are;

A single autohwitelistdelivery.txt file. (maybe break it up by domain and have SF check each domain list for change and reload if needed. memory and cpu would not be an issue as this would probably be a dedicated box since its in a larger environment)

Sharing of blacklists and whitelists (they synch up or put them on a single shared data drive, but then again, if that shared drive fails your entire antispam system fails. I think every server running SF should have its own set of files but synced periodically over time.

Maybe have a version of SF (call it Multi-SF ;-) that costs a little more per server but gives us an upgrade path in case we get lucky enough to grow.

The thought of having to go through all the pain of evaluating new anti-spam products scares the heck out of me and I'm really happy with SF today, but can see a point in time where the current single server centric model could become a liability.

Anyone else have any thoughts on their being a need for a 'Multi-SF" version?

Roberto,

   Good idea about the replication. The autowhitelistdelivery.txt then becomes the bottleneck for us. We are almost at 3 meg and wonder when that size gets too big.

Another concern is the authowhitelistdelivery.txt can not be mirrored because when using the quantine db and an entry gets tagged for delivery, which server (assuming 2 for now) would get tasked with updating the quarantine db (assuming you have 1 db) and delivering the email into the queue. Would you mirror this file on size, latest date? If 2 different users released 2 different emails and they were handled by 2 different servers at about the same time, then updating can become an issue.

Any thought to splitting up the autowhitelistdelivery.txt file into multiple files that only get loaded every minute if changed? Maybe along domain names boundries?

Thanks for a great product, just trying to make sure it can grow along with us.

Then the last  concern is the size of the autowhitelistdelivery.txt file and having only one.

We use it in a non-conventional way by parsing our outgoing email server log for outgoing emails and adding FROM|TO pairs into the autowhitelistdelivery.txt file thereby whitelisting the addresses of the customers our users send emails to. Its doing good for now but the question is what number will break the camels back as far as size.

KwikStix,

Please look at the log format plugin and tell me what version that is.  It is in the LogAnalysisInfo/log_formats/logsat_spam_filter_isp.cfg file and should read:

# Updated to match new log entries - Dec-30-2005 Dan Seligmann, Mags Net, LLC
log.format.format_label = "LogSat SpamFilterISP Log Format B500.8"

Get the latest at:

http://spamman.mags.net/sawmill/logsat_spam_filter_isp.cfg

Kwikstix,

Here is the problem ... even if you overwrite the log plug-in, you have to delete and re-create the "Profile" or the Sawmill profile will continue to use the existing (old) format.  This means you have to re-import all your logs.  This was a pain in the arse for me when I update my log format but I deal with it.

Please try that and let me know if you still get "wimpy" data.  You should get up to 7 actions and hmmmm, around 20-35 reasons depending on your SpamFilter options and setup.

Please get back to me as I want to make sure this is working for ALL installs.  BTW, which SpamFilter version are you running?  Older versions may not parse as well.

Kwikstix,

Very glad to hear it works now.  Did you purchase SawMill or are you going to purchase it?  If so, would you mind terribly letting Greg over at SawMill know you are using it for the LogSat logs and saw my postings?  His address is  ferrar at flowerfire dot com. I do not know if it will get me anything but I do bug him a lot and he is VERY helpfull over there and letting him know that his time spent over the last year has actually led to a sale would be nice.

I hope SpamFilterISP works as well for you as it has for me.  I do not think I have EVER gotten the kind of support that Roberto gives us from any other product.  THANKS Roberto ... and don't forget your parachute!