Excessive Swapping

[Richard Frovarp]

Gregory Wong wrote:
> Hi everyone,
>
> I have a server that has 256MB of RAM. It is running Postfix, MS, 
> MailScanner-MRTG on Ubuntu Server. I have noticed recently that it has 
> been swapping a lot.
>
> total used free shared buffers cached
> Mem: 256 204 51 0 0 18
> -/+ buffers/cache: 185 70
> Swap: 511 152 359
>
> I am looking to implement MailWatch but am concerned that the server 
> doesn’t have an adequate amount of memory. Is this excessive swapping 
> normal? Should I be upgrading the RAM?
>
> Also, my company got hit on Saturday with nearly 1600 spam messages 
> (which is unusual since we only get about 200-300 spam per day). 
> Besides running MS and the default SA rules, what other things do you 
> recommend I configure to help combat the spam?
>
> Thanks.

MailWatch might not be too bad, if you can move the DB and primary web 
interface off to another machine. Of course this is assuming you are 
only going to use MailWatch for quarantine management.

Your problem is you are receiving more spam than normal, so you probably 
are processing larger batch sizes, which requires more ram per batch. 
I've seen this with one of my boxes that only has 1 GB of RAM. Three 
things you can do while waiting for more RAM in MailScanner.conf:

Change Max Children to a small number
Change Max Unscanned Messages Per Scan to a small number
Change Max Unsafe Messages Per Scan to a small number

It may take longer to process mail, but swapping will make things slow 
to a horrible crawl, which is worse. Max Children would probably only be 
2 or 3, with messages per scan probably being something like 5 each.