I've been running SA on a Cobalt Qube since 2.42 was current, and it's been a wonderful solution. Recently I moved to running spamd -d to because of the increased load the increase in spam was putting on the server. Now that's not cutting it- they're hitting me so hard I'm seeing processor loads in the 30's, and my poor little Qube is buckling under the load- I can't ssh in, email exchanges time out, ect.
What else can I do to make SA run as quickly as possible- besides the obvious "buy a bigger server"?
First, you said you're running spamd -d... did you replace calls to spamassassin with spamc? Otherwise using spamd doesn't help at all.
You can limit the load by using the -m parameter to spamd, forcing it to limit the number of children, but then you need to use -f on spamc, resulting in unfiltered mail.
You can also gain speed, at a sacrifice of accuracy, by disabling network checks (razor, dnsbls, etc), bayes, and the AWL. Also ejecting some add-on rulesets helps. A good first-check to find any culprits is to run a message through spamassassin -D and see if it's getting "hung up" anywhere along the way. If you're not on a current version (2.6x) you could be suffering from a dead DNSBL.
Another method of dealing with it all is to limit the number of emails fed to SA in the first place.. This usually requires an integration tool that does queuing, like MailScanner. Of course, with this kind of system you wind up trading off CPU load for increased queue depth and delayed mail delivery. However, if you mail load is "bursty" and not continuous over the whole day, this will deal with the spikes pretty nicely.
