<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=ProgId content=Word.Document>
<meta name=Generator content="Microsoft Word 10">
<meta name=Originator content="Microsoft Word 10">
<link rel=File-List href="cid:filelist.xml@01C8FDF9.5228F8C0">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="time"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<!--[if gte mso 9]><xml>
<o:OfficeDocumentSettings>
<o:DoNotRelyOnCSS/>
</o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:WordDocument>
<w:SpellingState>Clean</w:SpellingState>
<w:GrammarState>Clean</w:GrammarState>
<w:DocumentKind>DocumentEmail</w:DocumentKind>
<w:EnvelopeVis/>
<w:Compatibility>
<w:ApplyBreakingRules/>
</w:Compatibility>
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
</w:WordDocument>
</xml><![endif]--><!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-parent:"";
margin:0in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;
text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;
text-underline:single;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"Times New Roman";}
code
{font-family:"Courier New";
mso-ascii-font-family:"Courier New";
mso-fareast-font-family:"Times New Roman";
mso-hansi-font-family:"Courier New";
mso-bidi-font-family:"Courier New";}
span.EmailStyle19
{mso-style-type:personal-reply;
mso-style-noshow:yes;
mso-ansi-font-size:10.0pt;
mso-bidi-font-size:10.0pt;
font-family:Arial;
mso-ascii-font-family:Arial;
mso-hansi-font-family:Arial;
mso-bidi-font-family:Arial;
color:navy;}
span.SpellE
{mso-style-name:"";
mso-spl-e:yes;}
span.GramE
{mso-style-name:"";
mso-gram-e:yes;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;
mso-header-margin:.5in;
mso-footer-margin:.5in;
mso-paper-source:0;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 10]>
<style>
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";}
</style>
<![endif]-->
</head>
<body lang=EN-US link=blue vlink=blue style='tab-interval:.5in'>
<div class=Section1>
<div>
<p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:
12.0pt;margin-left:.5in'><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'>Thank you very much for all the tips.<o:p></o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:
12.0pt;margin-left:.5in'><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'>It was a virus scanner issue.<span
style='mso-spacerun:yes'> </span>I upgraded to the latest <span
class=SpellE>ClamAV</span> and switched to <span class=SpellE>clamd</span>
instead of the default <span class=SpellE>clamavmodule</span> as suggested by Eduardo.<span
style='mso-spacerun:yes'> </span>I changed “Virus Scanners = auto<span
class=GramE>“ <span style='mso-spacerun:yes'> </span>to</span> “Virus
Scanners = <span class=SpellE>clamd</span>“.<span
style='mso-spacerun:yes'> </span>It is running like a champ now!<o:p></o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:
12.0pt;margin-left:.5in'><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'>This command: “<span class=SpellE>MailScanner</span>
–lint” was very helpful in narrowing the cause too.<o:p></o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:
12.0pt;margin-left:.5in'><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'>Thanks again,<o:p></o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:
12.0pt;margin-left:.5in'><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'>Best regards,<o:p></o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:
12.0pt;margin-left:.5in'><st1:place><font size=3 color=navy
face="Times New Roman"><span style='font-size:12.0pt;color:navy'>Nasser</span></font></st1:place><font
color=navy><span style='color:navy'><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>2008/8/13 Nasser Al-Zawawi <<a
href="mailto:nassera@alz-inc.com">nassera@alz-inc.com</a>><o:p></o:p></span></font></p>
<div link=blue vlink=purple>
<div>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Hi,</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>I have a Dell PowerEdge server 2950 with 2 Dual Core
Xeon processors 3.0GHz with 2GB RAM running RedHat ES 4. The MTA is
sendmail and I am using the latest MailScanner version (4.70.7-1). The
system processes about 2,000 emails per day and about half of it are
spam. See the following:</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>#---------------</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>MailScanner Status:</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>
1920 messages Scanned by MailScanner</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>
73657132 Total Bytes</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>
1122 Spam messages detected by MailScanner</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>
6 Viruses found by MailScanner</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>
935 Messages delivered by MailScanner</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>#---------------</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>The mail delivery is very slow. Some time it
takes 2 hrs before it gets delivered. I tried the tips under <a
href="http://wiki.mailscanner.info/doku.php?id=documentation:tweaking:some_things_to_try_if_your_incoming_queue_is_running_slow"
target="_blank">http://wiki.mailscanner.info/doku.php?id=documentation:tweaking:some_things_to_try_if_your_incoming_queue_is_running_slow</a>
but they did not help. The mail keeps accumulating under /var/spool/<a
href="http://mqueue.in" target="_blank">mqueue.in</a> while all the MailScanner
processors are running at 100% CPU. Then all the sudden (after 1-2 hours)
it starts delivering the emails and the /var/spool/<a href="http://mqueue.in"
target="_blank">mqueue.in</a> files go down to 0.</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>I monitored the system today; the system stopped
delivering emails between </span></font><st1:time Hour="9" Minute="12"><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>9:12AM</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> till </span></font><st1:time
Hour="11" Minute="35"><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>11:35AM</span></font></st1:time><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>. During that time, top showed
something like this:</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>#----------------</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>top - </span></font><st1:time Hour="10" Minute="46"><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>10:46:26</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> up 3
days, </span></font><st1:time Hour="19" Minute="42"><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>7:42</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>, 1
user, load average: 5.81, 6.09, 5.48</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Tasks: 233 total, 5 running, 226
sleeping, 0 stopped, 2 zombie</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Cpu(s): 59.0% us, 1.2% sy, 0.0% ni, 39.5%
id, 0.2% wa, 0.0% hi, 0.0% si</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Mem: 2074600k total, 1735692k
used, 338908k free, 22524k buffers</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Swap: 2097144k total, 356516k
used, 1740628k free, 532576k cached</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> PID USER
PR NI VIRT RES SHR S %CPU %MEM
TIME+ COMMAND</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> 2752 root
25 0 85572 75m 2964 R 100 3.7 35:54.85
MailScanner</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> 2880 root
25 0 85572 75m 2956 R 100 3.7 35:50.35
MailScanner</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> 3024 root
25 0 85572 75m 2956 R 100 3.7 35:41.62
MailScanner</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> 2949 root
25 0 85572 75m 2956 R 100 3.7 35:47.07
MailScanner</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>11393 apache 15 0 26360
9736 3648 S 5 0.5 0:57.14 httpd</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>11394 apache 15 0 26576
9936 3616 S 5 0.5 0:58.83 httpd</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>26598 root
16 0 4760 2568 1648 S 1
0.1 0:00.20 ssh</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>#----------------</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>and the /var/spool/<a href="http://mqueue.in"
target="_blank">mqueue.in</a> continued to accumulate files till it reached 489
messages, then within 5 minutes it delivered all the messages!</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>This cycles continues all day long, where the emails
are withheld for 1 to 2 hours and then the get delivered in one big burst.</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Here are snippets of the log for that period with
"</span></font><code><font size=2 face="Courier New"><span
style='font-size:10.0pt'>Log Speed = yes":</span></font></code><o:p></o:p></p>
<p style='margin-left:.5in'><font size=3 face=Arial><span style='font-size:
12.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>grep ": Batch" /var/log/maillog</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>#-----------</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Aug 13 </span></font><st1:time Hour="9" Minute="12"><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>09:12:16</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> samba
MailScanner[5852]: Batch completed at 1844 bytes per second (39583 / 21)</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Aug 13 </span></font><st1:time Hour="9" Minute="12"><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>09:12:16</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> samba
MailScanner[5852]: Batch (2 messages) processed in 21.46 seconds</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Aug 13 </span></font><st1:time Hour="9" Minute="12"><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>09:12:42</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> samba
MailScanner[6013]: Batch completed at 3752 bytes per second (9167 / 2)</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>…</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Aug 13 </span></font><st1:time Hour="11" Minute="28"><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>11:28:55</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> samba
MailScanner[2949]: Batch (10 messages) processed in 24.54 seconds</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Aug 13 </span></font><st1:time Hour="11" Minute="28"><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>11:28:55</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> samba
MailScanner[3024]: Batch completed at 657 bytes per second (3825 / 5)</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Aug 13 </span></font><st1:time Hour="11" Minute="28"><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>11:28:55</span></font></st1:time><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> samba
MailScanner[3024]: Batch (1 message) processed in 5.82 seconds</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>#-----------</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>I would appreciate any clues on resolving this issue.</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
</div>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Are you using a local caching dns? dns are critical,
remove rbl checking to see if speed increases.<br>
<br>
Do you use clamavmodule? switch to clamd, are you using tmpfs for /var/spool/MailScanner/incomming?
<br>
<br>
delete spamassassin cache and the bayes DB. sometimes they get corrupted and
mess things up.<br>
<br>
Regards,<br>
<br>
Eduardo.<o:p></o:p></span></font></p>
</div>
</div>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
</div>
</div>
</body>
</html>