Question

[Glenn Steen]

On 05/09/06, Ken A <ka at pacific.net> wrote:
>
>
> Rob Poe wrote:
> >> I have a client with an older linux box running MailScanner and it's just being crushed ... with spam....
> >>
> >> It's a Celeron 2.0 ghz / 512mb ram / dual IDE disk
> >>
> >>  10:55:02  up 19:05,  1 user,  load average: 6.23, 4.56, 4.04
> >
> >> Seeing things like this:  Sep  5 10:56:12 mail MailScanner[25809]: Batch processed in 61.70 seconds
> >>
> >> I've tried 5, 3 and now 2 MS children.
> >>
> >
> >> What does 'free' report? Using swap? Increase MS children up to 4 or 5
> >> until they start using swap, or add ram if they are already swapping.
> >
> >             total       used       free     shared    buffers     cached
> > Mem:        479644     447512      32132          0      93536     161792
> > -/+ buffers/cache:     192184     287460
> > Swap:      2112440       4356    2108084
>
> Looks like you are pushing it already at 2 children. More memory would
> help. You should be able to run 4 MS processes with a GB of ram.

Ah, beg to differ, if but a tad...:-)
  There is quite a bit of free memory there (both really free and
"readily returnable":-), so that isn't likely "it". The total is a bit
off from 512 MiB, which indicate that the machine have some memory
snitched by a "share memory" VGA adapter (or similar)... Install the
cheapest real VGA card you can find and disable the share-memory
thing, if possible. And get some more real RAM, a big swap is just a
crutch:-)

But that's neither here nor there. The tiny amount of swap used
doesn't really tell much.... "vmstat 2" is the tool to look to first,
to see if you have any swap in/out activity (I'm guessing you'll not
see much in that department:-).

The high load means you're either waiting for CPU or I/O. Good tools
to look at this (apart from what vmstat can tell you) are top, sar and
iostat (start with top and iostat, which will help you determine
what's up in the short term, and then move on to setting sar up....
that way you'll get some history to lean on in the future:).

Does the system feel "sluggish" under the heavy load, or perhaps like
it sometimes get stuck, then unclogs... or is it fairly responsive to
keyboard input?

> What about the network tests in SA? Are they running slowly? Are you
> getting SA timeouts too? You could run 'spamassassin -D dns < /dev/null'
> to get the list of rbls that SA is using and test them individually to
> see if one of them is timing out? It would be nice if there was a script
> for diagnosing MailScanner slowness. There are a lot of things that can
> cause it, but most are pretty obvious - AFTER you find them. :-)
>
Without more forensic data, I'm thinking you're near the target Ken.
Long I/O waits can really drive load through the roof. Especially if
one has a lot of lookups to do, and a relatively congested network, or
a piece of cr*p NIC. And that would still leave you with a
"mysteriously responsive" system:-).

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se