OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re[2]: performance

From: Kev (savage-gardenhanikamail.com)
Date: Tue Jan 03 2006 - 01:07:43 CST


On Tue, 3 Jan 2006 07:41:19 +0100
Magnus Bäck <magnusdsek.lth.se> wrote:

> On Tuesday, January 03, 2006 at 06:05 CET,
> Kev <savage-gardenhanikamail.com> wrote:
>
> > http://www.sa-blacklist.stearns.org/sa-blacklist/sa-blacklist.current
>
> (File with 341k lines.)
>
> > i was thinking about using that list with my sender_access list,
> > how much performance will i be loosing with this ?
>
> Probably very little, perhaps not even a measurable loss, but why don't you
> measure it yourself? Build an indexed database using different map types
> (hash, btree, cdb etc) and measure the lookup time with "postmap -q".
> Compare with measurements of lookups against a very small database so you
> know the constant-time overhead of postmap(1).

i was thinking about using the list in a DNS server (rhsbl) so i can use
the same list in few box's.

> > is it a good ida to use such a BIG list ?
>
> It's hardly a performance problem, but would it really stop that much
> crap? Spammers often change their sender addresses, so I expect 99.9 %
> of the domains in that list won't hit your server in a million years.
> Static blacklists are not the best way to fight spam.
>

well, with this file and my logs im seeing like 10-15% of the same kind
a spam comming for weeks or less. thats why i was thinking to use this.

thank you Magnus for the reply.