On Friday, August 20, 2004, 3:11:20 PM, Jeff Chan wrote:
On Friday, August 20, 2004, 9:24:10 AM, Mike Atkinson wrote:
On 8/19/2004 at 4:20 PM, Jeff Chan wrote:
Does anyone mind if we try this out and see what effect it has on traffic?
Go for it!
OK I'm changing the TTLs on all tue SURBL lists to 25 minutes which is a midway point between the 20 minutes I was going to try for SC and the 30 minutes we proposed for the rest of the lists. 25 minutes is also a good sampling frequency to capture data that has a 1 hour characteristic frequency.
This is mainly an experiment to see what effect it has on DNS traffic. If the traffic on SC is not a lot lower, I'll change it back to 10 minutes. If the traffic on the other lists is not a lot higher, I'll leave it at 25 minutes.
Summary of different TTLs we've tried in the past two weeks:
Week 1: SC 10 minute TTLs, others zones 1 hour Week 2: All zones 25 minute TTLs
After one week of the zones at 25 minute TTLs, I think we can see the following patterns:
http://nmrl.kconline.com/rbldnsd/
SC traffic is about one sixth lower (2500 average weekday queries per 5 minutes versus about 3000)
Other formerly 1 hour zones are nearly unchanged or only slightly higher in traffic at the reduced 25 minute TTL.
multi is a special case since it's the default SpamAssassin 3.0 list. It seems to be rising, but that's perhaps best explained by growth in SA 3 adoption, especially given that the other individual lists like ws, be, ab, ob (which SA 3 does not use) look relatively unchanged.
So I'd like to propose reducing the TTLs further from 25 to 20 minutes. If traffic across all lists rises a lot, then we can probably say 25 to 20 minutes is a critical point. We know that traffic is significantly higher at 10 minutes from SC, but let's see if it goes up much at 20.
I'm going to go ahead and make this change now unless there are major objections. If the traffic at 20 is not up a lot, perhaps we'll try 15 minute TTLs next week. At some point it should rise and we would back off. But we don't need to try 10 minutes since we already know it results in higher traffic.
Comments?
BTW I'm aware that doing this on a Friday evening is not the best way to get feedback. ;-)
Jeff C.