<div dir="ltr"><br><br><div class="gmail_quote">2008/8/13 Nasser Al-Zawawi <span dir="ltr"><<a href="mailto:nassera@alz-inc.com">nassera@alz-inc.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Hi,</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">I have a Dell PowerEdge server 2950 with 2 Dual Core Xeon
processors 3.0GHz with 2GB RAM running RedHat ES 4.<span> </span>The MTA is sendmail and I am using the
latest MailScanner version (4.70.7-1).<span>
</span>The system processes about 2,000 emails per day and about half of it are
spam.<span> </span>See the following:</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">#---------------</span></font></p>
<p><font size="2" face="Courier New"><span style="font-size: 10pt;">MailScanner
Status:</span></font></p>
<p><font size="2" face="Courier New"><span style="font-size: 10pt;"><span> </span>1920 messages
Scanned by MailScanner</span></font></p>
<p><font size="2" face="Courier New"><span style="font-size: 10pt;"><span> </span>73657132 Total
Bytes</span></font></p>
<p><font size="2" face="Courier New"><span style="font-size: 10pt;"><span> </span>1122 Spam
messages detected by MailScanner</span></font></p>
<p><font size="2" face="Courier New"><span style="font-size: 10pt;"><span> </span>6 Viruses found
by MailScanner</span></font></p>
<p><font size="2" face="Courier New"><span style="font-size: 10pt;"><span> </span>935
Messages delivered by MailScanner</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"></span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">#---------------</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">The mail delivery is very slow.<span> </span>Some time it takes 2 hrs before it gets
delivered.<span> </span>I tried the tips under <a href="http://wiki.mailscanner.info/doku.php?id=documentation:tweaking:some_things_to_try_if_your_incoming_queue_is_running_slow" target="_blank">http://wiki.mailscanner.info/doku.php?id=documentation:tweaking:some_things_to_try_if_your_incoming_queue_is_running_slow</a>
but they did not help.<span> </span>The mail
keeps accumulating under /var/spool/<a href="http://mqueue.in" target="_blank">mqueue.in</a> while all the MailScanner
processors are running at 100% CPU.<span>
</span>Then all the sudden (after 1-2 hours) it starts delivering the emails
and the /var/spool/<a href="http://mqueue.in" target="_blank">mqueue.in</a> files go down to 0.</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">I monitored the system today; the system stopped delivering
emails between </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">9:12AM</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> till </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">11:35AM</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">.<span> </span>During that time, top showed something
like this:</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">#----------------</span></font></p>
<p><span><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">top</span></font></span><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> - </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">10:46:26</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> up 3 days,<span> </span></span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">7:42</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">,<span> </span>1 user,<span> </span>load average: 5.81, 6.09, 5.48</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Tasks: 233 total,<span>
</span>5 running, 226 sleeping,<span>
</span>0 stopped,<span> </span>2 zombie</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Cpu(s): 59.0% us<span>,<span> </span>1.2</span>% sy,<span> </span>0.0% ni, 39.5% id,<span> </span>0.2% <span>wa</span>,<span> </span>0.0% hi,<span> </span>0.0% <span>si</span></span></font></p>
<p><span><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Mem</span></font></span><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">:<span> </span>2074600k total<span>,<span> </span>1735692k</span> used,<span> </span>338908k free,<span> </span>22524k buffers</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Swap:<span> </span>2097144k
total,<span> </span>356516k used<span>,<span> </span>1740628k</span>
free,<span> </span>532576k cached</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"><span> </span>PID USER<span> </span><span>PR<span> </span>NI</span><span> </span>VIRT<span> </span>RES<span>
</span>SHR S %CPU %MEM<span>
</span>TIME+<span> </span>COMMAND</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"><span> </span>2752 root<span> </span>25<span> </span>0 <span>85572<span> </span>75m</span> 2964 R<span> </span>100<span>
</span>3.7<span> </span>35:54.85 MailScanner</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"><span> </span>2880 root<span> </span>25<span> </span>0 <span>85572<span> </span>75m</span> 2956 R<span> </span>100<span>
</span>3.7<span> </span>35:50.35 MailScanner</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"><span> </span>3024 root<span> </span>25<span> </span>0 <span>85572<span> </span>75m</span> 2956 R<span> </span>100<span>
</span>3.7<span> </span>35:41.62 MailScanner</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"><span> </span>2949 root<span> </span>25<span> </span>0 <span>85572<span> </span>75m</span> 2956 R<span> </span>100<span>
</span>3.7<span> </span>35:47.07 MailScanner</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">11393 apache<span> </span>15<span> </span>0 26360 9736 3648 S<span> </span><span>5<span> </span>0.5</span><span> </span>0:57.14 <span>httpd</span></span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">11394 apache<span> </span>15<span> </span>0 26576 9936 3616 S<span> </span><span>5<span> </span>0.5</span><span> </span>0:58.83 <span>httpd</span></span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">26598 root<span> </span>16<span> </span><span>0<span> </span>4760</span> 2568 1648 S<span> </span>1<span> </span>0.1<span> </span>0:00.20 <span>ssh</span></span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">#----------------</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p><span><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">and</span></font></span><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> the
/var/spool/<a href="http://mqueue.in" target="_blank">mqueue.in</a> continued to accumulate files till it reached 489
messages, then within 5 minutes it delivered all the messages!</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">This cycles continues all day long, where the emails are
withheld for 1 to 2 hours and then the get delivered in one big burst.</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Here are snippets of the log for that period with "</span></font><code><font size="2" face="Courier New"><span style="font-size: 10pt;">Log Speed =
yes":</span></font></code></p>
<p><font size="3" face="Arial"><span style="font-size: 12pt; font-family: Arial;"> </span></font></p>
<p><span><span><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">grep</span></font></span></span><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> ":
Batch" /<span>var/log/maillog</span></span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">#-----------</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Aug 13 </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">09:12:16</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> samba <span>MailScanner[</span>5852]: Batch completed at 1844 bytes per second
(39583 / 21)</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Aug 13 </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">09:12:16</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> samba <span>MailScanner[</span>5852]: Batch (2 messages) processed in 21.46
seconds</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Aug 13 </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">09:12:42</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> samba <span>MailScanner[</span>6013]: Batch completed at 3752 bytes per second
(9167 / 2)</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">…</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Aug 13 </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">11:28:55</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> samba <span>MailScanner[</span>2949]: Batch (10 messages) processed in 24.54
seconds</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Aug 13 </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">11:28:55</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> samba <span>MailScanner[</span>3024]: Batch completed at 657 bytes per second
(3825 / 5)</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">Aug 13 </span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">11:28:55</span></font><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> samba <span>MailScanner[</span>3024]: Batch (1 message) processed in 5.82
seconds</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">#-----------</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;">I would appreciate any clues on resolving this issue.</span></font></p>
<p><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial;"> </span></font></p></div></div></blockquote><div>Are you using a local caching dns? dns are critical, remove rbl checking to see if speed increases.<br>
<br>Do you use clamavmodule? switch to clamd, are you using tmpfs for /var/spool/MailScanner/incomming? <br><br>delete spamassassin cache and the bayes DB. sometimes they get corrupted and mess things up.<br><br>Regards,<br>
<br>Eduardo.<br></div></div><br></div>