Mailscanner and memory resources

[Martin Hepworth]

Julian Field wrote:
> At 16:38 23/01/2004, you wrote:
>
>>  I've started using some of the SA ruleset like tripwire, bigevil and
>> such.  In doing so, I'm finding that the size of the MailScanner
>> processes increase dramatically because each MailScanner process is
>> essentially it's own SA process and loads all the configs and rules it
>> needs.  Wouldn't it be better to just have MailScanner make calls to
>> spamd thus reducing the amount of resources?
>
>
> In my view, no. You are running far more extra rulesets than most people
> do. Is the 119Mb per process the resident size (RSS in "top"), or just the
> (larger) "size" figure quoted in "top"? It's only the RSS figure that
> counts.
>
> Calling spamd would be slower and, more importantly, would rely on you
> having a daemon running, which introduces a whole host of reliability and
> recovery problems. I would have to write a whole system to handle memory
> leaks (and other resource leaks) in spamd, and be able to detect when it
> stops working properly and restart it. That's a very messy process, and is
> the same reason I don't support the daemonised versions of the virus
> scanning engines.
>
>>   On my system with 2gigs of
>> Ram and running 10 MailScanner processes, each process is 119megs with
>> these rulesets "BIGEVIL TRIPWIRE BACKHAIR WEEDS2 CHICKENPOX ANTIDRUG
>> EVILNUMBERS BLACKLIST BLACKLIST_URI"
>>
>> -=Bobby

Runnning all the of the above on a 512MB system and top shows a RSS of
51888K! Time to buy more memory I guess. BUT I see around 4 secs per
message in actual processing time so right now I'm just using 42MB of
swap to cover me..




--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************