Mailscanner message delays / load issue
a.peacock at chime.ucl.ac.uk
Tue Jun 26 09:43:19 IST 2007
Alistair Carmichael wrote:
> Over the past few months we have noticed a steady increase in the load
> on our 2 mail scanner servers and in the last few days messages have
> been substantially delayed between being collected from the inbound
> mailqueue to the outbound mailqueue. We are running mailscanner version
> mailscanner-4.53.8-1 on centos running linux kernel 2.6.9-55 and using
> sendmail 8.13 as the MTA and clamav as the anti-virus software and
> spamassassin as the anti spam software.
> We receive approximately 30,000 messages each day which are handled by a
> cluster of 2 servers via DNS round robin, the load on both machines is
> steadily at about 5,5,5 with clamscan processes constantly being at the
> top of the process list in terms of cpu usage. We are also seeing log
> entries similar to this constantly appearing in the maillog.
> MailScanner: Commercial scanner clamav timed out!
> MailScanner: Virus Scanning: Denial Of Service attack is in
> message l5Q7bntD008994
> Both servers are high powered machines only running the mailscanner
> software (xeon 2.8 cpu and 2gb ram in each machine)
> Is there a reason that the load would be so high as there’s not a huge
> quantity of email going through the servers for what I would expect them
> to handle, or if there are any configuration tuning that can be done in
> mailscanner to resolve this (we’ve fine tuned the time out settings in
> sendmail to minimise message delays but this hasn’t lowered the load or
> message delivery time)
How are you calling ClamAV?
The last couple of versions of Clam have slowed things down greatly. I
was getting similar problems to yours (as were others, look in the list
archives), and changing to use the new clamd support completely fixed
the slowdown for me.
CHIME, Royal Free & University College Medical School
"A CAT scan should take less time than a PET scan. For a CAT scan,
they're only looking for one thing, whereas a PET scan could result in
a lot of things." - Carl Princi, 2002/07/19
More information about the MailScanner