Mailscanner message delays / load issue

[Anthony Peacock]

Hi,

Alistair Carmichael wrote:
> Hi,
> 
>  
> 
> Over the past few months we have noticed a steady increase in the load 
> on our 2 mail scanner servers and in the last few days messages have 
> been substantially delayed between being collected from the inbound 
> mailqueue to the outbound mailqueue. We are running mailscanner  version 
> mailscanner-4.53.8-1 on centos running linux kernel 2.6.9-55 and using 
> sendmail 8.13 as the MTA and clamav as the anti-virus software and 
> spamassassin as the anti spam software.
> 
> We receive approximately 30,000 messages each day which are handled by a 
> cluster of 2 servers via DNS round robin, the load on both machines is 
> steadily at about 5,5,5 with clamscan processes constantly being at the 
> top of the process list in terms of cpu usage. We are also seeing log 
> entries similar to this constantly appearing in the maillog.
> 
> MailScanner[31171]: Commercial scanner clamav timed out!
> 
> MailScanner[31171]: Virus Scanning: Denial Of Service attack is in 
> message l5Q7bntD008994
> 
> Both servers are high powered machines only running the mailscanner 
> software (xeon 2.8 cpu and 2gb ram in each machine)
> 
> Is there a reason that the load would be so high as there’s not a huge 
> quantity of email going through the servers for what I would expect them 
> to handle, or if there are any configuration tuning that can be done in 
> mailscanner to resolve this (we’ve fine tuned the time out settings in 
> sendmail to minimise message delays but this hasn’t lowered the load or 
> message delivery time)

How are you calling ClamAV?

The last couple of versions of Clam have slowed things down greatly.  I 
was getting similar problems to yours (as were others, look in the list 
archives), and changing to use the new clamd support completely fixed 
the slowdown for me.

-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"A CAT scan should take less time than a PET scan.  For a CAT scan,
  they're only looking for one thing, whereas a PET scan could result in
  a lot of things."    - Carl Princi, 2002/07/19