Question

[Ken A]

Glenn Steen wrote:
> On 05/09/06, Ken A <ka at pacific.net> wrote:
>>
>>
>> Rob Poe wrote:
>> >> I have a client with an older linux box running MailScanner and 
>> it's just being crushed ... with spam....
>> >>
>> >> It's a Celeron 2.0 ghz / 512mb ram / dual IDE disk
>> >>
>> >>  10:55:02  up 19:05,  1 user,  load average: 6.23, 4.56, 4.04
>> >
>> >> Seeing things like this:  Sep  5 10:56:12 mail MailScanner[25809]: 
>> Batch processed in 61.70 seconds
>> >>
>> >> I've tried 5, 3 and now 2 MS children.
>> >>
>> >
>> >> What does 'free' report? Using swap? Increase MS children up to 4 or 5
>> >> until they start using swap, or add ram if they are already swapping.
>> >
>> >             total       used       free     shared    buffers     
>> cached
>> > Mem:        479644     447512      32132          0      93536     
>> 161792
>> > -/+ buffers/cache:     192184     287460
>> > Swap:      2112440       4356    2108084
>>
>> Looks like you are pushing it already at 2 children. More memory would
>> help. You should be able to run 4 MS processes with a GB of ram.
> 
> Ah, beg to differ, if but a tad...:-)
>  There is quite a bit of free memory there (both really free and
> "readily returnable":-), so that isn't likely "it". The total is a bit
> off from 512 MiB, which indicate that the machine have some memory
> snitched by a "share memory" VGA adapter (or similar)... Install the
> cheapest real VGA card you can find and disable the share-memory
> thing, if possible. And get some more real RAM, a big swap is just a
> crutch:-)

Our mailscanner processes are ~100mb each. So... did you used to try to 
squeeze and extra 10k out of your 386 dos machine, so you could run 
doom? :-)

> But that's neither here nor there. The tiny amount of swap used
> doesn't really tell much.... "vmstat 2" is the tool to look to first,
> to see if you have any swap in/out activity (I'm guessing you'll not
> see much in that department:-).

good catch. It is hard to tell from the 'free' report above what is 
actually happening, and vmstat will show you that and more.

> The high load means you're either waiting for CPU or I/O. Good tools
> to look at this (apart from what vmstat can tell you) are top, sar and
> iostat (start with top and iostat, which will help you determine
> what's up in the short term, and then move on to setting sar up....
> that way you'll get some history to lean on in the future:).

Another plus from adding some ram is that you can add a nameserver to 
the box to speed up rbl lookups and/or a rbldnsd to serve them locally.

Ken A.
Pacific.Net

> Does the system feel "sluggish" under the heavy load, or perhaps like
> it sometimes get stuck, then unclogs... or is it fairly responsive to
> keyboard input?
> 
>> What about the network tests in SA? Are they running slowly? Are you
>> getting SA timeouts too? You could run 'spamassassin -D dns < /dev/null'
>> to get the list of rbls that SA is using and test them individually to
>> see if one of them is timing out? It would be nice if there was a script
>> for diagnosing MailScanner slowness. There are a lot of things that can
>> cause it, but most are pretty obvious - AFTER you find them. :-)
>>
> Without more forensic data, I'm thinking you're near the target Ken.
> Long I/O waits can really drive load through the roof. Especially if
> one has a lot of lookups to do, and a relatively congested network, or
> a piece of cr*p NIC. And that would still leave you with a
> "mysteriously responsive" system:-).
>