Question

[Logan Shaw]

On Tue, 5 Sep 2006, Rob Poe wrote:
> Is there a way to start MailScanner so that it processes any messages
> in it's queue, but does not accept new incoming messages?

Well, it's a queue that sendmail and MailScanner share (sendmail
is the producer, MailScanner is the consumer), so it's not
really MailScanner that controls whether messages are accepted.

You could kill the incoming sendmail, but I don't recommend it.

> I have a client with an older linux box running MailScanner and it's just being crushed ... with spam....
>
> It's a Celeron 2.0 ghz / 512mb ram / dual IDE disk
>
> 10:55:02  up 19:05,  1 user,  load average: 6.23, 4.56, 4.04
>
> Running access lists in Sendmail (to block out other countries) and running the greet_pause feature (which is helping a lot)
>
> Seeing things like this:  Sep  5 10:56:12 mail MailScanner[25809]: Batch processed in 61.70 seconds
>
> I've tried 5, 3 and now 2 MS children.

With a situation like this, you have to determine whether CPU
or memory is the limiting factor.  There are some third-party
rulesets which are serious CPU hogs.  One of those could explain
the problem.  Or you could be too low on RAM and swapping,
which will kill performance and drive the load average through
the roof without getting much work done.

Personally, I would diagnose this problem by temporarily
setting the MailScanner children to 1.  As long as you don't
have other processes on the machine hogging the memory, that
will almost definitely eliminate memory as a bottleneck.
(On the other hand, 2 children is pretty close to 1.)

Then check the logs and see how many messages are in a batch
and the total time it takes to process that batch.  If a batch
takes 61.70 seconds, that could be OK if it's processing 10
or 20 or 30 messages, especially if your virus checker(s)
use lots of CPU.  At my site, with McAfee and ClamAV, it
takes something like 3 CPU-seconds to process a message,
sometimes more.  But if 61.70 seconds is the time for 2 or
3 messages, then you've got a problem.  More than 5 or 10
seconds per message is definitely excessive, even on a Celeron.

   - Logan