On Wed, 2009-06-03 at 22:00 +0000, Luis campo wrote:
> this is an example of var / log / qmail / spamd
>
> 2009-06-03 12:00:16.471682500 [775] info: spamd: result: Y 15 -
> DCC_CHECK,DIGEST_MULTIPLE,HTML_MESSAGE,MIME_HTML_ONLY,MISSING_DATE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,RDNS_NONE,URIBL_BLACK
>
> scantime=8.3,size=5837,user=fri...@ec-red.com,uid=89,required_score=3.0,rhost=172.16.10.9,raddr=172.16.10.9,rport=47584,mid=<789509335664072.ftlwktkqdskf...@[85.94.122.108]>,autolearn=spam
Something is working, somehow...
> 2009-06-03 12:00:16.531889500 [19168] info: prefork: child states: BBBBBBBBBB
> 2009-06-03 12:00:16.531949500 [19168] info: prefork: server reached
> --max-children setting, consider raising it
There's your problem.
You got 10 spamd children, all BUSY. That's what the 'B's mean.
Since you got 1 GByte of RAM, you could try increasing the number of
children. *Slowly*. If you exceed what your system's RAM can handle,
you'll hit swap and thrashing will kill the server.
Hmm, given this occurs after a while of operation only, that might be
exactly it. Swap thrashing? What does the command 'free' return?
Another possibility is, that you are scanning all messages regardless,
including really *large* messages. You shouldn't scan messages larger
than, say, 0.5 MByte.
The scantime of 8-10s is somewhat reasonable, probably caused by the
issue we're trying to nail. With normal operation and the hardware
capable of running the children, it should be considerably lower, like a
few seconds average, with some occasional spikes. That's too long for a
normal average.
Do you have any third-party rule-sets installed? Using sa-update, which
channels? Any custom cf files or something? Anything you added?
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
