Help! ....We are taking 120k msgs per day and climbing

[Michael Emdy]

Killing MailScanner-MRTG did the trick, brought our load back down to normal
levels:

08:04:37  up 1 day, 14:00,  4 users,  load average: 1.52, 1.50, 1.46

Hopefully this problem is fixed in the next release, is there any
safer/better way to run MailScanner-MRTG, showing the stats and results help
justify it's existence in our organization to the pointy haired bosses.

I don't think it's the quarantine directory as it's been holding over a 1000
files or more in the past without incident.

Thanks,

MTE

-----Original Message-----
From: Julian Field [mailto:mailscanner at ecs.soton.ac.uk]
Sent: Wednesday, June 16, 2004 1:33 PM
To: michael at emdy.com
Cc: mailscanner at jiscmail.ac.uk
Subject: Re: Help! ....We are taking 120k msgs per day and climbing

You seem to have a lot of MRTG processes running. Stop those to start with.
They shouldn't be hogging CPU like that, something is definitely wrong.
With a couple of HT Xeons you should be able to set Max Children to about
12 or thereabouts.

Other than that, the standard optimisation procedures apply as described in
the MAQ. The location of the MAQ is at the bottom of every posting. Read
that and make sure you have done all of that. Also you can move
SpamAssassin's temp files to tmpfs either by editing the init.d script and
adding
         export TMPDIR=/var/spool/MailScanner/SpamAssassin
just before the line that runs check_mailscanner and mounting that
directory with tmpfs. Or else you can just move /tmp onto tmpfs which is
what things like Solaris do anyway.

At 18:07 16/06/2004, you wrote:
>We're having excessively high loads (see below, let me know if anyone
>wants to see something else)  even though we have implemented MailScanner
>now using the XBL+SBL, and using whitelist/blacklists our volume continues
>to grow.  We need to take action to stop the flood of mail, we're getting
>hit by every trick in the book it seems but we can only do so much.  The
>MailScanner gateway has offloaded and provided protection to our internal
>MS Exchange system but at this rate it won't last long either.
>
>Any suggestions would be greatly appreciated to help us optimize the
>Mailscanner gateway or actions we could take to help cut down our volume.
>
>Some questions we have is, should we reject or discard mail at the
>Sendmail level or take other actions to bounce mail?
>
>
>It appears that there are alot of processes in the queue that are fighting
>for cpu time, not sure what this is caused by, perhaps it's alot of open
>connections waiting for input.
>
>Below i've included detailed info in a text file (to avoid wasting
>bandwidth) to paint a picture of our system and maybe you can see a
>problem that i don't.
>
><http://www.ewebtricity.net/email-stats.txt>http://www.ewebtricity.net/emai
l-stats.txt
>
>thanks for your help in advance
>
>MTE
>
>
>
>-------------------------- MailScanner list ----------------------
>To leave, send leave mailscanner to
><mailto:jiscmail at jiscmail.ac.uk>jiscmail at jiscmail.ac.uk
>Before posting, please see the Most Asked Questions at
><http://www.mailscanner.biz/maq/>http://www.mailscanner.biz/maq/ and the
>archives at
><http://www.jiscmail.ac.uk/lists/mailscanner.html>http://www.jiscmail.ac.uk
/lists/mailscanner.html

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html