Mailscanner message delays / load issue

[Alistair Carmichael]

Hi,

Thanks for all the fast responses, a bit of further testing using
clamscan at the command line on very small files takes a very long time
and we will look at changing either to clamd or the clamavmodule. Is it
possible to use the clamavmodule without installing new packages other
than the vendors distributions / new versions the reason I ask is that
we manage all software packages centrally with a strict policy on what's
installed. I guess that I would need to modify the virus.scanners.conf
and create a wrapper as the path for clamavmodule is currently /bin/conf
whilst all others are paths to the av wrapper file or does the
clamavmodule when defined in the main config get called in a different
way.

Thanks again

Al

 

 

________________________________

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Julian
Field
Sent: 26 June 2007 10:00
To: MailScanner discussion
Subject: Re: Mailscanner message delays / load issue

 

My best advice would be to upgrade to 4.61.3 and use the direct clamd
support. If you don't want to upgrade then use clamavmodule. Download my
clam+SA package and install it, just tell it not to install ClamAV when
it asks you. This will install the support for clamavmodule.

The current version of Clam is *very* slow at starting up, while it
loads the virus database.

Alistair Carmichael wrote: 

Hi,

 

Over the past few months we have noticed a steady increase in the load
on our 2 mail scanner servers and in the last few days messages have
been substantially delayed between being collected from the inbound
mailqueue to the outbound mailqueue. We are running mailscanner  version
mailscanner-4.53.8-1 on centos running linux kernel 2.6.9-55 and using
sendmail 8.13 as the MTA and clamav as the anti-virus software and
spamassassin as the anti spam software.

We receive approximately 30,000 messages each day which are handled by a
cluster of 2 servers via DNS round robin, the load on both machines is
steadily at about 5,5,5 with clamscan processes constantly being at the
top of the process list in terms of cpu usage. We are also seeing log
entries similar to this constantly appearing in the maillog.

MailScanner[31171]: Commercial scanner clamav timed out!

MailScanner[31171]: Virus Scanning: Denial Of Service attack is in
message l5Q7bntD008994

Both servers are high powered machines only running the mailscanner
software (xeon 2.8 cpu and 2gb ram in each machine)

Is there a reason that the load would be so high as there's not a huge
quantity of email going through the servers for what I would expect them
to handle, or if there are any configuration tuning that can be done in
mailscanner to resolve this (we've fine tuned the time out settings in
sendmail to minimise message delays but this hasn't lowered the load or
message delivery time)

 

Thanks for any help

Al

 


This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the
system manager. This message contains confidential information and is
intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail.





Jules
 
-- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
 
MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM
 
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk


This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the
system manager. This message contains confidential information and is
intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail.


This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070626/5dc61ba5/attachment.html