Server Spec for MailScanner

[James Gray]

Pete wrote:
> I think i have successfully lobbied for a 'new' replacement server for
> MailScanner at work.
> we originally installed to prove it would work and re used ancient
> hardware we had lying around, 2xp200 NEC server, the newer releases of
> MS have meant this machine not longer cuts it, even for our 3k messages
> for day.

Well done.  Convincing manglement the box-that-no-one-sees is at the end
of it's useful life is often difficult.

> So, we buy second had compaq proliant servers from a local vendor, with
> original 3 yr compaq onsite warranty.
>
> Additionally i am lobbying to re route our new parent companies mail via
> our mail scanner, so our volume may double/triple. they currently have
> NO protection, just 2 exchange 2000 servers in the DMZ with NAV,
> needless to say they have many days of no email at all.
>
> For 6k - 9k emails per day, running Clamav and etrust would something
> like a Proliant ML370 2 x P3 800/1GB RAM and scsi HDD running either
> suse or red hat 9 (my FreeBSd skills are not sufficient for this yet) be
> enough horsepower? Alternately our vendor has a single Ml310 P2.8 /1GB
> Ram and scsi. will mailScanner benefit more from dual CPU or faster CPU
> considering the load i described above? Or would I be better off spend
> more on RAM? 1 GB seems like plenty of RAM to me, but then again i
> havent processed 9k emails before, and some of you have, so hopefully
> some one could advised on which hardware will benefit MS more?

OK, here's some 'real-world' stats from one of my gateway machines where
I work (BTW - I wrote the script - more like "hack" - that generates
this....e-mail me off list if you want to see it):

The following are statistics for Saturday  6-March-2004

Total Spam Found:              6743
Total Clean Found:             2866
Total Messages Processed:      9609
Total kilobytes Processed:     56753.8 kb
Total Viruses Detected:        0  <--- OOPS! forgot to edit the virus
                                        scanners config file after
                                        upgrading 4.27.7 -> 4.28.5!
Messages with bad attachments: 46

Clean:   29.8262% (16927.5 kb)
Spam:    70.1738% (39826.3 kb)
Viruses: 0% (0 kb)

Throughput averages for mail filter:*
Average size per message:     6048.06 bytes
Average seconds per message:  2.00104 sec
Average messages per minute:  29.9844 msg/min
Average Virus Scanner t'put:  9801.96 bytes/sec
MailScanner Average t'put:    3022.46 bytes/sec
Theoretical max messages/day: 43177.5 msg/day
Today's theoretical load:     22.2546 %

* These represent the time used by MailScanner,
   not the absolute 24hr period

The server's vitals:
Compaq Proliant DL360 G2 (so I'm told - never seen it; it's in Boston,
I'm in Sydney, Australia :P )
CPU:          1 x P3 1.2GHz
RAM:          1024MB ECC
Disk:         4 x U320 15,000RPM 36GB - 3 in RAID5 (72GB) with 1 hot
               spare.  All done from the hardware RAID controller.
OS:           FreeBSD 4.8
MailScanner:  4.28.5
Anit-Virus:   NAI/McAfee VirusScan 4.3.20
SpamAssassin: 2.63 + 1300 custom rules :P
Additional:   Razor (clients v2.36)

I also have a backup machine running the same software except it's a
Celeron433 with 512MB ram and a single IDE hard drive.  Even with it's
modest power can still manage around 10,000 messages per day
(theoretical max).  The most it's ever handled is about 7,500/day.

On the Proliant machine, everything happens in RAM - no swap is used.
Obviously there's some disk i/o for the mail queues and delivery etc.
Our experience is that MailScanner works better if you tweak the number
of children and incoming queue check interval so that each child picks
up more than one message for each run.  For us that means 3 children and
8sec check interval.  Each child now picks up around 2-3 messages each
time and consequently the throughput is better :)  Your numbers might
vary - as you can see, our average message size is fairly small (6kB)
which something fairly site-specific.  Our web and fax systems use
e-mail to fire messages to each other :-/  I didn't design the software.

Basically, MailScanner is one of the most efficient pieces of software
I've had the pleasure of administering.  A single P3-800 with 512MB RAM
and half-decent (read SCSI, maybe SATA?) disk subsystem wont even break
a sweat chewing through 10,000 messages a day :)

Good luck, and have fun configuring your new toys!

Cheers,

James