<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>Performance issues with MS and SA </TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I would like to get some input from the community on our performance issue.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Running 'MailScanner --debug --debug-sa' points to DCC as a bottleneck and Bayes.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Turning off Bayes and DCC makes a big difference, but I would like to keep DCC.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">We are running 4 MX servers each with 4 CPU and 3.5 GB of memory. We process about 150k emails over the 4 MX servers, excluding rejected, aborted and incomplete messages.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Software:</FONT>
<BR><FONT SIZE=2 FACE="Arial">MailScanner: 4.83.4-1</FONT>
<BR><FONT SIZE=2 FACE="Arial">SpamAssassin: 3.3.1</FONT>
<BR><FONT SIZE=2 FACE="Arial">Scam-Back: 1.5.1-pre2 (checks email recipient against internal Exchange server)</FONT>
<BR><FONT SIZE=2 FACE="Arial">OS: Fedora Core 8 (want to upgrade to RedHat Enterprise)</FONT>
<BR><FONT SIZE=2 FACE="Arial">DCC: Current version</FONT>
<BR><FONT SIZE=2 FACE="Arial">Pyzor: Latest - servers: public.pyzor.org:2444</FONT>
<BR><FONT SIZE=2 FACE="Arial">Razor: 2.84</FONT>
<BR><FONT SIZE=2 FACE="Arial">Sendmail: 8.14.2 with:</FONT>
<UL>
<P><FONT SIZE=2 FACE="Courier">ClientRate: 3</FONT>
<BR><FONT SIZE=2 FACE="Courier">ClientConn: 3</FONT>
</P>
</UL>
<P><FONT SIZE=2 FACE="Arial">Here's are our settings in spam.assassin.prefs.conf:</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier">dns_available yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">bayes_path /var/spool/spamassassin/bayes</FONT>
<BR><FONT SIZE=2 FACE="Courier">bayes_ignore_header X-BakerBotts-MailScanner</FONT>
<BR><FONT SIZE=2 FACE="Courier">bayes_ignore_header X-BakerBotts-MailScanner-SpamCheck</FONT>
<BR><FONT SIZE=2 FACE="Courier">bayes_ignore_header X-BakerBotts-MailScanner-SpamScore</FONT>
<BR><FONT SIZE=2 FACE="Courier">bayes_ignore_header X-BakerBotts-MailScanner-Information</FONT>
<BR><FONT SIZE=2 FACE="Courier">lock_method flock</FONT>
<BR><FONT SIZE=2 FACE="Courier">use_auto_whitelist 0</FONT>
<BR><FONT SIZE=2 FACE="Courier">ifplugin Mail::SpamAssassin::Plugin::DCC</FONT>
<BR><FONT SIZE=2 FACE="Courier">dcc_path /usr/local/bin/dccproc</FONT>
<BR><FONT SIZE=2 FACE="Courier">endif</FONT>
<BR><FONT SIZE=2 FACE="Courier">rbl_timeout 10</FONT>
<BR><FONT SIZE=2 FACE="Courier">razor_timeout 10</FONT>
<BR><FONT SIZE=2 FACE="Courier">pyzor_timeout 10</FONT>
<BR><FONT SIZE=2 FACE="Courier">envelope_sender_header X-BakerBotts-MailScanner-From</FONT>
<BR><FONT SIZE=2 FACE="Courier">score BAYES_00 -0.400</FONT>
<BR><FONT SIZE=2 FACE="Courier">score BAYES_05 -0.300</FONT>
<BR><FONT SIZE=2 FACE="Courier">score BAYES_20 -0.200</FONT>
<BR><FONT SIZE=2 FACE="Courier">header __RCVD_IN_ZEN eval:check_rbl('zen', 'zen.dnsbl.', '127.0.0.[124]')</FONT>
<BR><FONT SIZE=2 FACE="Courier">header RCVD_IN_XBL eval:check_rbl('sblxbl-lastexternal', 'xbl.dnsbl.', '127.0.0.4')</FONT>
<BR><FONT SIZE=2 FACE="Courier">header RCVD_IN_SBL eval:check_rbl_sub('sblxbl', 'zen.dnsbl.', '127.0.0.2')</FONT>
<BR><FONT SIZE=2 FACE="Courier">header RCVD_IN_PBL eval:check_rbl('zen-lastexternal', 'zen.dnsbl.', '127.0.0.10')</FONT>
<BR><FONT SIZE=2 FACE="Courier">uridnsbl URIBL_SBL sbl.dnsbl. TXT</FONT>
<BR><FONT SIZE=2 FACE="Courier">score RCVD_IN_BSP_TRUSTED -0.5</FONT>
<BR><FONT SIZE=2 FACE="Courier">header __FROM_YOURDOMAIN From =~ /\@bakerbotts\.com\b/i</FONT>
<BR><FONT SIZE=2 FACE="Courier">meta SPF_FAIL_YOURDOMAIN (SPF_FAIL && __FROM_YOURDOMAIN)</FONT>
<BR><FONT SIZE=2 FACE="Courier">score SPF_FAIL_YOURDOMAIN 1.0</FONT>
<BR><FONT SIZE=2 FACE="Courier">score USER_IN_WHITELIST -1.0</FONT>
<BR><FONT SIZE=2 FACE="Courier">score SUBJECT_IN_WHITELIST -1.0</FONT>
<BR><FONT SIZE=2 FACE="Courier">score USER_IN_SPF_WHITELIST -1.0</FONT>
<BR><FONT SIZE=2 FACE="Courier">score USER_IN_ALL_SPAM_TO -1.0</FONT>
<BR><FONT SIZE=2 FACE="Courier">score FB_GET_MEDS 2.5</FONT>
<BR><FONT SIZE=2 FACE="Courier">score GENERIC_IXHASH 4.5</FONT>
<BR><FONT SIZE=2 FACE="Courier">score NIXSPAM_IXHASH 4.5</FONT>
<BR><FONT SIZE=2 FACE="Courier">score CTYME_IXHASH 4.5</FONT>
<BR><FONT SIZE=2 FACE="Courier">score HOSTEUROPE_IXHASH 4.5</FONT>
<BR><FONT SIZE=2 FACE="Courier">score DRUGS_ERECTILE 1.50</FONT>
<BR><FONT SIZE=2 FACE="Courier">score RCVD_IN_DNSWL -1.00</FONT>
<BR><FONT SIZE=2 FACE="Courier">score LOTTERY_PH_004470 4.0</FONT>
<BR><FONT SIZE=2 FACE="Courier">score ALL_TRUSTED -0.5</FONT>
<BR><FONT SIZE=2 FACE="Courier">internal_networks 204.194.96/21</FONT>
<BR><FONT SIZE=2 FACE="Courier">internal_networks 63.241.249.0/25</FONT>
<BR><FONT SIZE=2 FACE="Courier">internal_networks 10/8</FONT>
<BR><FONT SIZE=2 FACE="Courier">header MS_FOUND_SPAMVIRUS exists:X-BakerBotts-MailScanner-SpamVirus-Report</FONT>
<BR><FONT SIZE=2 FACE="Courier">score MS_FOUND_SPAMVIRUS 3.0</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Here is our custom MailScanner file in /etc/MailScanner/conf.d:</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier">Max Children = 9</FONT>
<BR><FONT SIZE=2 FACE="Courier">Queue Scan Interval = 10</FONT>
<BR><FONT SIZE=2 FACE="Courier">Max Normal Queue Size = 2000</FONT>
<BR><FONT SIZE=2 FACE="Courier">Unrar Command = #/usr/bin/unrar</FONT>
<BR><FONT SIZE=2 FACE="Courier">Allow Password-Protected Archives = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Check Filenames In Password-Protected Archives = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Allowed Sophos Error Messages =</FONT>
<BR><FONT SIZE=2 FACE="Courier">Dangerous Content Scanning = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Find Phishing Fraud = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Also Find Numeric Phishing = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Use Stricter Phishing Net = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Highlight Phishing Fraud = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Allow IFrame Tags = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Allow Form Tags = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Allow Object Codebase Tags = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Quarantine Infections = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Information Header Value = Please contact Baker Botts IT Help Desk for more information</FONT>
<BR><FONT SIZE=2 FACE="Courier">Always Include SpamAssassin Report = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Sign Clean Messages = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Mark Infected Messages = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Mark Unscanned Messages = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Notify Senders = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Notify Senders Of Blocked Filenames Or Filetypes = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Notify Senders Of Other Blocked Content = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Virus Modify Subject = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Filename Modify Subject = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Content Modify Subject = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Size Modify Subject = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Disarmed Modify Subject = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Spam Modify Subject = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">High Scoring Spam Modify Subject = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Archive Mail = /var/spool/MailScanner/archive</FONT>
<BR><FONT SIZE=2 FACE="Courier">Send Notices = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Spam Checks = %rules-dir%/spam.checks.rules</FONT>
<BR><FONT SIZE=2 FACE="Courier">Is Definitely Not Spam = &SpamWhiteList('/etc/MailScanner/rules/bb_ms_custom.whitelist')</FONT>
<BR><FONT SIZE=2 FACE="Courier">Is Definitely Spam = %rules-dir%/spam.blacklist.rules</FONT>
<BR><FONT SIZE=2 FACE="Courier">Definite Spam Is High Scoring = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Ignore Spam Whitelist If Recipients Exceed = 40</FONT>
<BR><FONT SIZE=2 FACE="Courier">Max Spam Check Size = 1500k</FONT>
<BR><FONT SIZE=2 FACE="Courier">Use Watermarking = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Treat Invalid Watermarks With No Sender as Spam = 9</FONT>
<BR><FONT SIZE=2 FACE="Courier">Watermark Secret = %org-name%-TvnSx97qf</FONT>
<BR><FONT SIZE=2 FACE="Courier">Required SpamAssassin Score = 5</FONT>
<BR><FONT SIZE=2 FACE="Courier">SpamAssassin Auto Whitelist = no</FONT>
<BR><FONT SIZE=2 FACE="Courier">Rebuild Bayes Every = 86400</FONT>
<BR><FONT SIZE=2 FACE="Courier">Wait During Bayes Rebuild = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">High Scoring Spam Actions = delete</FONT>
<BR><FONT SIZE=2 FACE="Courier">Log Speed = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Log Spam = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Log Non Spam = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">Log Delivery And Non-Delivery = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier">SpamAssassin Timeout = 120</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">Donald Dawson</FONT>
<BR><FONT SIZE=2 FACE="Arial">Security Administrator</FONT>
<BR><FONT SIZE=2 FACE="Arial">Baker Botts L.L.P.</FONT>
<BR><FONT SIZE=1 FACE="Arial">One Shell Plaza</FONT>
<BR><FONT SIZE=1 FACE="Arial">910 Louisiana</FONT>
<BR><FONT SIZE=1 FACE="Arial">Houston, TX 77002</FONT>
<BR><FONT SIZE=1 FACE="Arial">W: 713-229-2183</FONT>
</P>
<p><span style="font-family:'Arial';font-size:10pt;"><b>Confidentiality Notice:</b></span><span style="font-family:'Arial';font-size:10pt;"> The information contained in this email and any attachments is intended only for the recipient[s] listed above and may be privileged and confidential. Any dissemination, copying, or use of or reliance upon such information by or to anyone other than the recipient[s] listed above is prohibited. If you have received this message in error, please notify the sender immediately at the email address above and destroy any and all copies of this message.</span></p>
<p><span style="font-family:'Arial';font-size:10pt;"> </span></p></BODY>
</HTML>