Mailscanner CPU Use

[Christian Campbell]

> > We are running MailScanner version 4.21-9 on a Red Hat 8.0 Dual
> > processor Intel box. It has been running great since it was
> install on
> > the new system in April. It was running under Red Hat 6.2
> previously.
>
> > here are the problems
> > 1st the number of Virii caught has dropped like a rock. The daily
> > average was 3-400 and it's now down to 2-4 We can trace the change
> > back to last Wednesday when the MailScanner service was restarted.
> > The log files show that Mailscanner is scanning email finding virii
> > or spam marking it and sending it on it's way. Sophs is the virus
> > software that is running on this system and this has been kept up to
> > date both via the monthly CD and the automated process. The
> automated
> > process runs hourly. It does not seem possible that the number of
> > Virii has decreased this much. That's very hard to swallow..
>
> > 2nd problem. Mailscanner is Consuming a Huge amount of CPU. Like 90%
> > of each CPU. It's MailScanner, because if you stop the
> Service the CPU
> > use Drops to near zero. There is plenty of Diskspace
> available and the
> > system does not seem to be I/O bound.
>
> As to the virus counts: believe them. The counts dropped *HUGELY* on
> 10 September, which by coincidence was the day you restarted
> MailScanner. The reason for the drop was that Sobig.F suicided on
> 10 September.
>
> Here are some mail statistics for 8 days around 10 Sept., from my
> day job's MailScanner box:
>
>                         Mail Statistics;
> Produced by isdmon2:/home/mikea/bin/mailstats.pl; Run by
> isdmon2:/etc/crontab
>          Mails   spamassassin   rejected      scanner
> total mails
>          Total   says 'spam'    by ruleset    says virus
> undelivered
>  Sep  13  2546  1416 (55.62%)  209 ( 8.21%)   11 ( 0.43%)
> 1636 (64.26%)
>  Sep  12  5478  1760 (32.13%)  333 ( 6.08%)   13 ( 0.24%)
> 2106 (38.44%)
>  Sep  11  5876  1812 (30.84%)  381 ( 6.48%)   15 ( 0.26%)
> 2208 (37.58%)
>  Sep  10  6495  1777 (27.36%)  418 ( 6.44%)   15 ( 0.23%)
> 2210 (34.03%)
>  Sep   9  6605  1785 (27.02%)  411 ( 6.22%)  439 ( 6.65%)
> 2635 (39.89%)
>  Sep   8  7100  1551 (21.85%)  456 ( 6.42%) 1017 (14.32%)
> 3024 (42.59%)
>  Sep   7  2734  1053 (38.51%)  181 ( 6.62%)  390 (14.26%)
> 1624 (59.40%)
>  Sep   6  2764  1144 (41.39%)  196 ( 7.09%)  303 (10.96%)
> 1643 (59.44%)
>

Any chance you could share the nifty script that generated that mail stats
report?

Christian