<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>MailScanner/Spamassassin slow after version upgrade</TITLE>
<META http-equiv=Content-Type content="text/html; charset=US-ASCII">
<META content="MSHTML 6.00.6000.16481" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=478045817-30072007><FONT size=2>How many
children are you running?</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=478045817-30072007><FONT
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=478045817-30072007><FONT size=2>Are you
running a caching DNS server for SA lookups?</FONT></SPAN></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><SPAN class=478045817-30072007><FONT size=2>what does 'MailScanner --debug
-debug-sa' look like?</FONT></SPAN></DIV>
<DIV><SPAN class=478045817-30072007><FONT size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=478045817-30072007><FONT size=2>One thing that made a
difference for me was uping my children from 5 to 10. Also lowering my "Max
Unsafe Messages Per Scan" to 10, and my "Max Unscanned Messages Per Scan" to 10
helped speed things up as well.</FONT></SPAN></DIV>
<DIV><SPAN class=478045817-30072007><FONT size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=478045817-30072007><FONT size=2>Hope that
helps.</FONT></SPAN></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV align=left><FONT size=2>David Gottschalk <BR></FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <B>On Behalf Of
</B>donald.dawson@bakerbotts.com<BR><B>Sent:</B> Monday, July 30, 2007 1:44
PM<BR><B>To:</B> mailscanner@lists.mailscanner.info<BR><B>Subject:</B>
MailScanner/Spamassassin slow after version upgrade<BR></FONT><BR></DIV>
<DIV></DIV><!-- Converted from text/rtf format -->
<P><FONT face=Arial size=2>The time it takes to process an email has doubled
since Friday (7/26/07) when I upgraded to MS 4.62.6 and SA 3.2.2. It was
around 3.5 seconds, and now it is averaging 7 seconds.</FONT></P>
<P><FONT face=Arial size=2>We use DCC and razor2 - no pyzor.</FONT> </P>
<P><FONT face=Arial size=2>Jul 30 12:36:35 houmx05 MailScanner[21682]: Batch (30
messages) processed in 187.50 seconds</FONT> <BR><FONT face=Arial size=2>Jul 30
12:37:06 houmx05 MailScanner[21662]: Batch (16 messages) processed in 105.59
seconds</FONT> <BR><FONT face=Arial size=2>Jul 30 12:37:24 houmx05
MailScanner[21727]: Batch (30 messages) processed in 196.20 seconds</FONT>
<BR><FONT face=Arial size=2>Jul 30 12:37:28 houmx05 MailScanner[21776]: Batch
(30 messages) processed in 211.89 seconds</FONT> <BR><FONT face=Arial size=2>Jul
30 12:37:38 houmx05 MailScanner[21793]: Batch (30 messages) processed in 223.64
seconds</FONT> </P>
<P><FONT face=Arial size=2>sar -u shows idle CPU time:</FONT> <BR><FONT
face=Arial size=2>12:00:01 AM CPU
%user %nice %system %iowait
%idle</FONT> <BR><FONT face=Arial
size=2>Average:
all 10.49
0.00 4.99
1.00 83.51</FONT> </P>
<P><FONT face=Arial size=2># uptime is normal</FONT> <BR><FONT face=Arial
size=2> 12:38:30 up 5 days, 25 min, 1 user, load average: 0.81,
0.79, 0.83</FONT> </P>
<P><FONT face=Arial size=2>I have implemented sa-compile using re2c expecting to
get a performance boost.</FONT> </P>
<P><FONT face=Arial size=2>'MailScanner --lint' doesn't show any errors, except
noting that we have clamav processing turned off (output attached).</FONT></P>
<P><FONT face=Arial size=2><<ms.txt>> </FONT><BR><FONT face=Arial
size=2>I have included output from spamassassin's lint command.</FONT> </P>
<P><FONT face=Arial size=2>/etc/mail/spamassassin contents:</FONT> <BR><FONT
face=Arial size=2>bakerbotts.cf - custom local rule file</FONT>
<BR><FONT face=Arial size=2>Botnet.cf</FONT> <BR><FONT face=Arial
size=2>Botnet.pm</FONT> <BR><FONT face=Arial size=2>init.pre</FONT> <BR><FONT
face=Arial size=2>init.pre.pre-v310</FONT> <BR><FONT face=Arial
size=2>KAM.cf</FONT> <BR><FONT face=Arial size=2>local.cf</FONT> <BR><FONT
face=Arial size=2>mailscanner.cf</FONT> <BR><FONT face=Arial
size=2>pdfinfo.cf</FONT> <BR><FONT face=Arial
size=2>sare-sa-update-channels.txt</FONT> <BR><FONT face=Arial
size=2>sa-update-keys</FONT> <BR><FONT face=Arial size=2>v310.pre</FONT>
<BR><FONT face=Arial size=2>v312.pre</FONT> <BR><FONT face=Arial
size=2>v320.pre</FONT> </P>
<P><FONT face=Arial size=2>contents of sare-sa-update-channels.txt used by
update_spamassassin:</FONT> </P>
<P><FONT face=Arial size=2>updates.spamassassin.org</FONT> <BR><FONT face=Arial
size=2>70_sare_adult.cf.sare.sa-update.dostech.net</FONT> <BR><FONT face=Arial
size=2>70_sare_bayes_poison_nxm.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_evilnum0.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial
size=2>70_sare_genlsubj0.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_genlsubj1.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial
size=2>70_sare_genlsubj2.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_header.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_highrisk.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial size=2>70_sare_html.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial size=2>70_sare_obfu.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial size=2>70_sare_oem.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial size=2>70_sare_random.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial
size=2>70_sare_specific.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_spoof.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_stocks.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_unsub.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_uri0.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_uri1.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_uri2.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_whitelist.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial
size=2>70_sare_whitelist_rcvd.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>70_sare_whitelist_spf.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial
size=2>72_sare_bml_post25x.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial
size=2>72_sare_redirect_post3.0.0.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>88_FVGT_headers.cf.sare.sa-update.dostech.net</FONT> <BR><FONT
face=Arial size=2>99_FVGT_Tripwire.cf.sare.sa-update.dostech.net</FONT>
<BR><FONT face=Arial
size=2>99_sare_fraud_post25x.cf.sare.sa-update.dostech.net</FONT> </P>
<P><FONT face=Arial size=2>Any ideas would be greatly appreciated.</FONT> </P>
<P><FONT face=Arial size=2>Thanks,</FONT> <BR><FONT face=Arial
size=2>Donald</FONT> </P>
<P><FONT face=Arial size=2>Donald Dawson</FONT> <BR><FONT face=Arial
size=2>Security Administrator</FONT> <BR><FONT face=Arial size=2>Baker Botts
L.L.P.</FONT> <BR><FONT face=Arial size=2>713-229-2183</FONT> </P></BODY></HTML>