Matias Lopez Bergero wrote: > Hello! > > I was very happy using SpamAssassin at my email server (Xeon 2.8GHz, > 1.5 GB memory, Dual Ultra SCSI HD 73.4GB in RAID 1, Linux 2.4.33) > > The last few weeks I have noted (angry users calling me by phone) > that the server is really slow. The loadav goes from 1.5 to 12.5; > normally is about 3.00. > > There are only 2500 email boxes at the server. The server is > running: Sendmail, SpamAssassin 3.1.5 (using milter-spamc), ClamAV > (using clamav-milter), Apache 1.3.x, SquirrelMail, pop3, etc. > > I have seeing some king of bursts of incoming emails (spam mostly), > that it is producing a DoS effect. > > The server shows a table of ~1700 processes and about ~800 tcp > sessions (sendmail and milter-spamc most) during this bursts. This > seems to prevent other users from connecting to the server in order > to use pop3 or smtp services. > > I have increased the child processes of spamd, but I was > unsuccessfully to reduce this effect(I have seing in the logs a > message about the need of increase the spamd childs). Also I tweak > the sendmail.cf to easy the connection, but the problem persist. > > Looks to me that SpamAssassin is taking to long to process the > incoming emails, and as result, it is slowing down the server, and > finally causing the DoS. > > Can anyone help me with some ideas to solve this? or to see were > exactly is the problem? Do I need to improve my hardware?
The message about increasing the child processes is frequently misleading. You may not have enough memory to deal with the children you already have. Run 'top' and see how much memory your child processes are using. If each child is more than 50-60MB, you probably have an add-on ruleset that is causing the problem. sa-blacklist, sa-blacklist-uri, and bigevil are the most common contributors to this problem. Remove them, restart spamd, and see what happens. If the children are a reasonable size, then you may simply have too many of them running. Take a look at your memory usage when the system gets slow. If you are using all of your memory, you need to reduce the number of child processes. Once your machine starts to swap, SA will run VERY slowly. A fewer number of fast processes will do better than a large number of slow ones. For more info on speeding up SA, take a look at the wiki: http://wiki.apache.org/spamassassin/FasterPerformance -- Bowie
