Spamassassin timeouts - Just an observation

[Kai Schaetzl]

Steve Campbell wrote on Thu, 15 Jan 2009 15:00:30 -0500:

> I still go back to the fact that two versions ago,

Two versions? I count that there is a difference of 13! And I bet you also 
upgraded SA and maybe added some rulesets.

> > Are you checking load average regularly? What does free tell about memory 
> > usage and swap?
> >   
> 
> I monitor load average with MailWatch up most of the day when problems 
> occur. We seem to have slow mornings with LA way below 1. The 
> afternoon's LA start climbing along with the input queue backlog. Right 
> now, we're about 50 minutes behind with about 500 messages waiting.
> 
> top tells me I'm using almost all memory with 200 MB swap being used. 

top is of almost no interest. But the 200 MB swap use shows that you have too 
few RAM. You didn't answer most of the very specific questions I asked. If you 
did we might be able to give you more tips. Just adding RAM won't tweak your 
system for "better" and faster processing it just removes the bottleneck for 
the current ressource needs.

> I wasn't sure I got all the scores zeroed. Just to make sure, I turned 
> on skip_rbl_checks. This caused the LA to steady out at about 4. It 
> would fluctuate as high as 8.

I don't know how much impact these checks should have to load. I always set 
skip_rbl_checks on my setups. I would think not much. But it may prolong the 
time the process stays in memory which means you need more RAM and run into 
swapping -> load goes up.

> You might have hit on something there with the size to hand over to SA. 
> I recently had to up this for some large files being emailed in. There's 
> a lawyer who was photocopying briefs, scanning them, and making a PDF to 
> send to someone here. The size was around 50MB. If the limit set up in 
> MS/SA is smaller than the size of the attachment being sent, it doesn't 
> deliver it and doesn't quarantine it.

I cannot follow that. I haven't ever seen or heard of such a problem. You do 
not need to set that value to the size of attachments. And, btw, why don't you 
just whitelist that specific sender?
Which setting exactly did you change and to what?

I wish there was an option to at 
> least quarantine it, but I haven't found it.

I don't understand. Why would you want to quarantine every attachment?

> As I stated earlier, this was just to ensure I got them all. The only 
> difference this made was the LA spike is now steadily around 4, so I 
> guess I missed a few with the score thing.

Well, it shows that switching those tests off helps you ;-) But not enough.


Kai

-- 
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com