Mailscanner CPU Use

[mikea]

On Thu, Sep 18, 2003 at 02:26:37PM -0400, William Mahler wrote:
> We are running MailScanner version 4.21-9 on a Red Hat 8.0 Dual
> processor Intel box. It has been running great since it was install on
> the new system in April. It was running under Red Hat 6.2 previously.

> here are the problems
> 1st the number of Virii caught has dropped like a rock. The daily
> average was 3-400 and it's now down to 2-4 We can trace the change
> back to last Wednesday when the MailScanner service was restarted.
> The log files show that Mailscanner is scanning email finding virii
> or spam marking it and sending it on it's way. Sophs is the virus
> software that is running on this system and this has been kept up to
> date both via the monthly CD and the automated process. The automated
> process runs hourly. It does not seem possible that the number of
> Virii has decreased this much. That's very hard to swallow..

> 2nd problem. Mailscanner is Consuming a Huge amount of CPU. Like 90%
> of each CPU. It's MailScanner, because if you stop the Service the CPU
> use Drops to near zero. There is plenty of Diskspace available and the
> system does not seem to be I/O bound.

As to the virus counts: believe them. The counts dropped *HUGELY* on
10 September, which by coincidence was the day you restarted
MailScanner. The reason for the drop was that Sobig.F suicided on
10 September.

Here are some mail statistics for 8 days around 10 Sept., from my
day job's MailScanner box:

                        Mail Statistics;
Produced by isdmon2:/home/mikea/bin/mailstats.pl; Run by isdmon2:/etc/crontab
         Mails   spamassassin   rejected      scanner       total mails
         Total   says 'spam'    by ruleset    says virus    undelivered
 Sep  13  2546  1416 (55.62%)  209 ( 8.21%)   11 ( 0.43%)  1636 (64.26%)
 Sep  12  5478  1760 (32.13%)  333 ( 6.08%)   13 ( 0.24%)  2106 (38.44%)
 Sep  11  5876  1812 (30.84%)  381 ( 6.48%)   15 ( 0.26%)  2208 (37.58%)
 Sep  10  6495  1777 (27.36%)  418 ( 6.44%)   15 ( 0.23%)  2210 (34.03%)
 Sep   9  6605  1785 (27.02%)  411 ( 6.22%)  439 ( 6.65%)  2635 (39.89%)
 Sep   8  7100  1551 (21.85%)  456 ( 6.42%) 1017 (14.32%)  3024 (42.59%)
 Sep   7  2734  1053 (38.51%)  181 ( 6.62%)  390 (14.26%)  1624 (59.40%)
 Sep   6  2764  1144 (41.39%)  196 ( 7.09%)  303 (10.96%)  1643 (59.44%)

I expect that my experience is much like yours.

If you don't trust Sophos, then you should consider adding another
virus scanner. I use ClamAV, which has two great advantages: it's free
and it's effective.

As to MailScanner eating CPU, is it because your SpamAssassin bayes
databases are huge and SA is having some sort of problem with them?
Exactly this happened to me about 6 weeks ago. The CPU usage returned
to normal when I blew the bayes databases away and relearned enough
spam and ham to get bayesian classification working again.

If you're not running SpamAssassin, that's another thing you should
give serious thought to doing -- once you fix the CPU-burner problem.

--
Mike Andrews
mikea at mikea.ath.cx
Tired old sysadmin since 1964