Upgrade to 4.26.8 and performance bottlenecks

Michael Dahlberg dahlberg at bucknell.edu
Wed Feb 18 01:25:07 GMT 2004

I recently upgraded our mail system from MailScanner 4.13 to 4.26.8
in order to correct a problem scanning messages with MyDoom-infected
attachments.  Certain messages would contain data that some MUAs would
not interpret as an attachment, while others would.  This data contained
an encoded version of the MyDoom virus.  MailScanner 4.13 would not detect
the virus-infected attachment while 4.26.8 would.

I am using Sophos 3.78(d) as the virus scanner
(virus scanner = sophossavi).  I do no spam analysis through
MailScanner, I don't have MailScanner look analyze attachments for
file type, and I don't block messages based on HTML tags.  I am
running MailScanner on a Sun Solaris dual SPARC II system with

My problem is that MailScanner 4.26.8 is SO SLOW that it can't keep
up with our mail flow (virus scanning speeds are between 1 - 3 kB/sec).
The problem is with MailScanner, since a
downgrade (which retains the same Sophos installation) to 4.13 returns
virus scanning back to its normal speed.  When we're not hit with
a virus outbreak we process 200,000 - 400,000 emails per day.

Has anyone observed this behavior? Can anyone offer a suggestion on
what I might try tuning to recover adequate performance?


More information about the MailScanner mailing list