On Wed, 2009-09-23 at 13:06 -0500, Jose Luis Marin Perez wrote:
> Dear Sirs
>
> A few moments ago I noticed that SA was not assigned any score for
> SPAM emails, reviewing the log I see this:
>
How long is SA taking to scan mails and what proportion of the total are
timing out and skipping the message?
Here are my results, taken from a scan over all available maillog files:
Average of 3902 messages
min avg max
Message size: 1547 7601 506031
Scan time (secs): 0.5 2.5 34.5
I run spamc/spamd on an 866 MHz P3 with 512 MB of RAM.
I also run a copy of named on the same machine, so UBL lookups, etc are
cached locally. If, after you reduce the SA process population to 5 as
others have suggested, your average scan times are significantly longer
than mine *and* the CPU usage of each child is low (you may be able to
get that by watching top or (better) running programs from the sysstat
package, especially pidstat. Running something like:
pidstat -C spamd -t -u 5 >pidstat.txt
should get the information you need. My spamd children are each running
at between 25-50% CPU utilisation according to pidstat. If yours are
running at a significantly lower CPU utilisation and taking longer to do
the scans you should consider running a DNS cache because almost
certainly they're being slowed down by DNS queries. Don't forget that
many/most blacklist checks use a DNS query mechanism to interrogate the
blacklist server.
Martin
PS: contact me offlist of you want a copy of the script I used to report
my SA scan statistics.
