MailScanner, huge bayes_toks, out-of-mem problem

[Pete russell]

Yep - I use a p200 (NEC Server class 5800) 256mb ram and SCSSI HDDs with
RH9 postfix mailscanner 4.24-5 SA2.6 and clamav.65? and we do less than
2500 (%30+ spam) emails a day with no hassles delays or mail stuck in
queues or any other faults whatsoever since installation a few weeks ago
- works, dare I say it, perfectly. I have 2 identical machines and use
the MX records to distribute the load and only ever 10 or so emails a
day on the second server - which is still valuable for hardware
redundancy - mailscanner was a truly ZERO cost implementation to us as
we had this hardware gathering dust.

Moral = even if just a pilot to show your boss how goods it works before
you beg for a shiny new duel xeon server, you can use your old hardware
for pilot without having any negative impacts on company mail.



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
Behalf Of Robert Waldner
Sent: Tuesday, 25 November 2003 9:18 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: MailScanner, huge bayes_toks, out-of-mem problem


On Tue, 25 Nov 2003 09:49:07 GMT, Martin Hepworth writes:
>> Ok, bayes_toks is _huge_, ~ 82M, but what I'm trying to understand
is:
>>  - how does MailScanner (SA?) determine which process will read in
the whole
>>    bayes_toks?
>>  - how does the size of bayes_toks correspond to the size of the
>>    MailScanner-process? bayes_toks is ~ 82M, I've seen
>>    MailScanner-processes with size 203M (RSS 58M), but usually
they're
>>    size < 50k, RSS < 30M (all values according to `top`)
>>
>> Yes, I could do with a smaller ham/spam corpus, but what I'd like to
>>  know before I nuke the bayes-db is if that's the problem and why.
>>  Maybe I could just throw in more memory, currently the box has 144
MB
>>  RAM, 256 MB swap.

>most people recommend at least 512MB RAM for a Mailscanner server. The
>more RAM the better especially if you are using GNU/Linux and tmpfs for
>the Mailscanner working area.
>
>I've got a 600Mhz celeron with 512MB ram, 1GB swap running on FreeBSD
>4.8, SA with Bayes but no RBL's anywhere, Mailwatch with a local
>database and it's handling 9-10K messages a day easily. (btw something
>like 75% of this is inbound spam!)

My colo-box is just a petty P1/133 Mhz, and it handles usually no more
 than 3.000 mails/day, mostly only about half of that. More than 192 MB
 RAM aren't possible due to hardware limitations.

It it weren't for those runaway MailScanners (SAs?), it'd cope just
fine,
 it handled more than 15.000 mails/day without problems with MS 4.22
 (or .23) and SA 2.5mumble when the latest mail-based worm struck.

cheers,
&rw
--
-- People who would give up their Freedom for security deserve
-- neither.                                - Benjamin Franklin