Mailscanner message delays / load issue

Tue Jun 26 11:03:11 IST 2007

Another alternative is to try out ClamAV 0.91RC2.

It's lightning-fast on startup.

Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK 

________________________________

	From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of
Alistair Carmichael
	Sent: 26 June 2007 10:53
	To: MailScanner discussion
	Subject: RE: Mailscanner message delays / load issue

	Hi,

	Thanks for all the fast responses, a bit of further testing
using clamscan at the command line on very small files takes a very long
time and we will look at changing either to clamd or the clamavmodule.
Is it possible to use the clamavmodule without installing new packages
other than the vendors distributions / new versions the reason I ask is
that we manage all software packages centrally with a strict policy on
what's installed. I guess that I would need to modify the
virus.scanners.conf and create a wrapper as the path for clamavmodule is
currently /bin/conf whilst all others are paths to the av wrapper file
or does the clamavmodule when defined in the main config get called in a
different way.

	Thanks again

	Al

________________________________

	From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Julian
Field
	Sent: 26 June 2007 10:00
	To: MailScanner discussion
	Subject: Re: Mailscanner message delays / load issue

	My best advice would be to upgrade to 4.61.3 and use the direct
clamd support. If you don't want to upgrade then use clamavmodule.
Download my clam+SA package and install it, just tell it not to install
ClamAV when it asks you. This will install the support for clamavmodule.

	The current version of Clam is *very* slow at starting up, while
it loads the virus database.

	Alistair Carmichael wrote: 

	Hi,

	Over the past few months we have noticed a steady increase in
the load on our 2 mail scanner servers and in the last few days messages
have been substantially delayed between being collected from the inbound
mailqueue to the outbound mailqueue. We are running mailscanner  version
mailscanner-4.53.8-1 on centos running linux kernel 2.6.9-55 and using
sendmail 8.13 as the MTA and clamav as the anti-virus software and
spamassassin as the anti spam software.

	We receive approximately 30,000 messages each day which are
handled by a cluster of 2 servers via DNS round robin, the load on both
machines is steadily at about 5,5,5 with clamscan processes constantly
being at the top of the process list in terms of cpu usage. We are also
seeing log entries similar to this constantly appearing in the maillog.

	MailScanner[31171]: Commercial scanner clamav timed out!

	MailScanner[31171]: Virus Scanning: Denial Of Service attack is
in message l5Q7bntD008994

	Both servers are high powered machines only running the
mailscanner software (xeon 2.8 cpu and 2gb ram in each machine)

	Is there a reason that the load would be so high as there's not
a huge quantity of email going through the servers for what I would
expect them to handle, or if there are any configuration tuning that can
be done in mailscanner to resolve this (we've fine tuned the time out
settings in sendmail to minimise message delays but this hasn't lowered
the load or message delivery time)

	Thanks for any help

	Al

	This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager. This message contains confidential information and
is intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail.

	Jules

	-- 
	Julian Field MEng CITP
	www.MailScanner.info
	Buy the MailScanner book at www.MailScanner.info/store

	MailScanner customisation, or any advanced system administration
help?
	Contact me at Jules at Jules.FM

	PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
	For all your IT requirements visit www.transtec.co.uk

	This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager. This message contains confidential information and
is intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail.

	This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager. This message contains confidential information and
is intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070626/b729ae30/attachment.html