Spamassassin timeouts - Just an observation

[Steve Campbell]

Kai Schaetzl wrote:
> Steve Campbell wrote on Thu, 15 Jan 2009 15:00:30 -0500:
>
>   
>> I still go back to the fact that two versions ago,
>>     
>
> Two versions? I count that there is a difference of 13! And I bet you also 
> upgraded SA and maybe added some rulesets.
>
>   
>>> Are you checking load average regularly? What does free tell about memory 
>>> usage and swap?
>>>   
>>>       
>> I monitor load average with MailWatch up most of the day when problems 
>> occur. We seem to have slow mornings with LA way below 1. The 
>> afternoon's LA start climbing along with the input queue backlog. Right 
>> now, we're about 50 minutes behind with about 500 messages waiting.
>>
>> top tells me I'm using almost all memory with 200 MB swap being used. 
>>     
>
> top is of almost no interest. But the 200 MB swap use shows that you have too 
> few RAM. You didn't answer most of the very specific questions I asked. If you 
> did we might be able to give you more tips. Just adding RAM won't tweak your 
> system for "better" and faster processing it just removes the bottleneck for 
> the current ressource needs.
>   

Which questions did I miss? Sorry, especially since you're being so 
helpful. And you're right about the RAM, also.
>   
>> I wasn't sure I got all the scores zeroed. Just to make sure, I turned 
>> on skip_rbl_checks. This caused the LA to steady out at about 4. It 
>> would fluctuate as high as 8.
>>     
>
> I don't know how much impact these checks should have to load. I always set 
> skip_rbl_checks on my setups. I would think not much. But it may prolong the 
> time the process stays in memory which means you need more RAM and run into 
> swapping -> load goes up.
>   
>   
>> You might have hit on something there with the size to hand over to SA. 
>> I recently had to up this for some large files being emailed in. There's 
>> a lawyer who was photocopying briefs, scanning them, and making a PDF to 
>> send to someone here. The size was around 50MB. If the limit set up in 
>> MS/SA is smaller than the size of the attachment being sent, it doesn't 
>> deliver it and doesn't quarantine it.
>>     
>
> I cannot follow that. I haven't ever seen or heard of such a problem. You do 
> not need to set that value to the size of attachments. And, btw, why don't you 
> just whitelist that specific sender?
> Which setting exactly did you change and to what?
>   
Max Spam Check Size

I did whitelist the user. Once this size limit was hit, the message was 
not delivered or quarantiined. The report in Mailwatch stated "File to 
large" or something like that. I upped this value and the same email was 
resent, and it came through just fine. Maybe it is dependent on another 
setting also. If Jules knows, maybe he could pipe in on this one.
> I wish there was an option to at 
>   
>> least quarantine it, but I haven't found it.
>>     
>
> I don't understand. Why would you want to quarantine every attachment?
>
>   
I don't want to quarantine every attachment. But I also don't want to 
just throw the entire email away once the max size is hit.
>> As I stated earlier, this was just to ensure I got them all. The only 
>> difference this made was the LA spike is now steadily around 4, so I 
>> guess I missed a few with the score thing.
>>     
>
> Well, it shows that switching those tests off helps you ;-) But not enough.
>
>
>   

I also removed ALL of the SARE rules until memory arrives. I'll then add 
them back as needed. The machine is running better, obviously, but I 
haven't hit the flood time yet. I find it hard to believe that all of 
this spam used to be sent over night, and now these guys are brazen 
enough to send it during work hours. Maybe the problem existed before 
and I just didn't notice.

Come to think of it, I added most of the SARE rules during the upgrade 2 
(13) versions ago when update_spamassassin came along. So maybe that's 
been my problem all along and the nightly flood wasn't realized. I need 
to watch mailscanner-mrtg more often.

> Kai
>
>   
Thanks Martin and Kai and all others,

Your ideas are really helping. I've not had to deal with this type of 
drudgery before from MS as it's always been so nearly-out-of-the-box 
great. Once I started messing with it, I guess I over messed.

steve