I am running qmail-scanner 1.21, spamassassin 2.63(spamd), clamav 0.70, File::Scan 1.15, also I have patched tcpserver to deny connections if the load average is greater than 12 or more than 5 connections from the same IP address. This alleviated the problem temporarily.
I would replace qmail-scanner 1.21 with qmail-spamc (for SpamAssassin processing) and qscanq (for ClamAV virus filtering). You would eliminate the Perl overhead of Qmail-Scanner and block incoming viruses at the qmail-smtpd level (cuts down on bounce message generation). I have been extremely happy with the results.
My knowledge of process accounting is limited, otherwise I'd try to recommend something that could report on how much processor time and swapping was caused by different programs.
If you don't have a lot of account adds/deletes/password-changes, then I'd think that going to CDB would be a good solution. You'll cut down on the memory overhead of MySQL connections, and looking up users in the CDB file should have a lower overhead.
What's the maximum number of users you have in a domain?
-- Tom Collins - [EMAIL PROTECTED] QmailAdmin: http://qmailadmin.sf.net/ Vpopmail: http://vpopmail.sf.net/ Info on the Sniffter hand-held Network Tester: http://sniffter.com/
