PureMessage for UNIX: HistorianDB questions

Question

We're preparing the update to PMX 6.4 (currently at 6.3.3). We do have multiple MTAs running PMX as well as a Centralized Server Manager running the quarantine database. 
 If I understood correctly, a Redis database is used for the new Delay Queue feature. And Redis only must exist once for the environment to actually make sense. 
 
 But while the quarantine DB isn't necessary for the frontends to filter spam properly, Redis would have an impact to my understanding. So Redis cluster it is... Is there an recommended way? Is such an setup even supported? Or am I following the wrong path?

Red_Warrior · Answer

Hi Wolfgang, 
 
 The redis db is its own db that should (ideally) be separate from the CSM/Spam DB. Normally in a multi edge scenario you would have (edge severs) (1 csm) and (1 redis) server. the edge servers report spam and gather config to/from the csm and only the edge servers report to the redis db. 
 
 at a very high level the feature works like this: 
 The redis server is used to collect MTA information that the edge servers report to it. This in turn allows you to create additional logic in your policy.siv file that gives the edge server the ability to query the DB for more information about the MTA .. for example, has ip this ip ever connected to me? has it relayed mail before? if so how much and was it legitimate or spam. 
 
 Under the hood it allows the labs team to create additional detection rules that specifically target snowshoe spam. 
 
 I would recommend that you install the redis DB and configure the /opt/pmx6/etc/delay.conf on the edge servers to point to its ip.. leave it set to collect. This will accept mta information from the edge servers but not enable the delay feature. (the feature must remain in collect for a minimum of 10.5 days before you can enable it). The longer its set to collect, the better the feature will work. So if it takes a month or two to poc and get rolling, your all ready to go from the start 
 
 the documentation can be found here: https://community.sophos.com/kb/en-us/127126