Email causing MailScanner to go defunct.

[Steve Campbell]

Kai Schaetzl wrote:
> Steve Campbell wrote on Fri, 23 Jan 2009 10:29:57 -0500:
>
>   
>> If I were to lower the size restrictions, the spam just flows on through 
>> cleanly with a score of 0, so I raise it, and of course, the load on the 
>> machine suffers because it has to scan the larger spams.
>>     
>
> I think most people's experience, including mine, is different. Over a 
> certain value (most likely 50 - 100k) there's almost no spam. (Nowadays, 
> they try to send short messages, so that Bayes hasn't much to work on.) So, 
> going with 200k is a good measure. I was just under the wrong impression 
> that the respective option was working like the usually used procmail 
> recipes.
>   

I too was under the same impression you were. I'm not sure if it's the 
comments above the option or not that gave me that impression.
> I think it would be a good idea to add this functionality (Spam Check only 
> first x Beytes of message") to MS.
>   

Same here.
> Part of your problems could indeed come from the fact that you are scanning 
> many large messages. How high did you set this option?
>   

Max Spam Check Size = 4000k
Max SpamAssassin Size = 2500000

High value, but like I said, there was a time when emails weren't 
delivered if it were above. Maybe I'm not using the right one.
> Another thought: in case you are getting so many spam with big size and 
> others don't - could it be that your rejection rate at the MTA level is 
> very low, so that you get spam in that others already reject at the door?
> If you detect a majority of spam only with MS and not at MTA this could 
> also be another reason for your performance problems.
>
>   
I'm only using sbl-xbl-spamhaus.org right now with my MTA. I've never 
compared rejected versus accepted, but when I tail my maillog, it seems 
as though most email is thrown away. If anyone has a safe suggestion for 
more that I should add to the MTA, please suggest. A lot of my incoming 
is from bursts from news agencies sending alerts to all reporters.

I just upgraded to the latest. I left startin and startout running. The 
load average dropped to around 0.50, so sendmail is taking minimal 
resources. Once I started MS back up, with about 250 emails queue in the 
input queue, LA rose to 6.5-7.0 and stayed there as it struggles to 
clear the queue along with the new incoming posts.

MS is showing a footprint of 92M, and most of the RAM (3 GB now for 3 
children) is eaten up. I've removed all SARE rules, and am considering 
cutting KAM rules.

There were a lot of failed modules during install. The two main ones 
installed fine. MS says it installed fine. I'm just wondering if that 
might have a bearing on this as I'm running Centos 3 here.

> Kai
>
>   
steve