Run top on the machines running spamd. If load is high, but there are
regular amounts of CPU idling, then network tests are slowing the
processes down and your servers aren't working to their potential. In
which case, have more spamd children ready to handle more simultaneous
activity, which may require more ram. Load is just the number jobs in
the run queue, not the slowness of the server, some of the jobs could be
awaiting network traffic. Dual CPU machines handle higher load better
then single CPU machines. if CPU is always fully tied up with user
processes, then you need more CPU, or fewer tests.
At the mx level, reject mail that fails sbl-xbl tests, doesn't have
valid HELO/EHLO, and isn't for valid users. That will drastically reduce
the volume your SA servers have to process. Make them as picky as you
can without getting tarred and feathered by your end users.
On Wed, Feb 08, 2006 at 04:33:44PM +0000, Ronan wrote:
> Im currently running 3 mailhubs into our uni which scan all mail.
> I have two dual-opteron boxes running spamd 3.1 w/ DCC, razor, pyzor,
> caching bind w/rbldnsd server for SURBL, {AWL,BAYES (running off
> seperate MySQL DB)} and various rules from SARE.
>
> The hubs scan the messags then route them to various hosts/domains.
>
> the boxes are in failover atm and im loathed to simply round robin the
> scanning to them as if one goes then were screwed, if no one is around
>
> During busy periods of the day the mailhubs start refusing new
> connections as the Spamd machine churns away on the existing emails and
> cant keep up with the rate.
>
> This is down purely to the network tests, becuase if I enable -L then
> the mails simply flood in.
>
> Im sure there are others out there who have had to draw the line between
> what options they can include in their scanning to get the best stable
> system vs performance.
>
> What I had in mind is this:
>
> At the MX level I simply run local tests only (we dont reject on
> spamscore. we simply tag) and route the message as normal to our hosts.
>
> Now on the hosts we could then run a version of SA without any of the
> rules but simply a 'network only' version ie SURBL,razor,pyzor etc and
> add whatever score is here to the headers in the message before
> deliveing to the local users mailbox. As at this stage we are no longer
> holding up any connections etc and the users can wait 10-20 extra
> seconds for their message before the network tests finsih/timeout...
>
> What modifications would be needed to SA to accomplish this or is this
> an MTA issue to rewrite the headers on the hosts?
>
> We run EXIM on all MTAs and hosts here so it shouldn't be too much of an
> issue at that level.
>
> What do you think?
>
> Ronan
>
>
> --
> Ronan McGlue
> Analyst / Programmer
> CMC Systems Group
>
> Queens University Belfast
--
/*
Jason Philbrook | Midcoast Internet Solutions - Internet Access,
KB1IOJ | Hosting, and TCP-IP Networks for Midcoast Maine
http://f64.nu/ | http://www.midcoast.com/
*/
