On Thu, 2007-10-25 at 09:23 -0400, Joey wrote: > I have a situation where CPU is just going through the roof on just a > few messages and I really can’t tell what part of SA is the slow down.
Since this happens for a few messages only, I would start by checking if these messages got something in common. Also, scanning really large messages can result in such an issue. How do you call SA? Is there and maximum message size for scanning in your mail chain, or do you unconditionally scan everything? Do these messages by any chance happen to be large? Throwing a huge list of REs at SA can have such an impact, too. An idea would be, to remove them and observe. Then, if the problem went away, put them back in one by one, and keep observing until you find the offender. As Jeff pointed out already, you should not be using blacklist.cf since it is obsoleted by an RBL (which you actually use). With >20M (!) this would the first ruleset I'd remove in case of anything smelling fishy anyway... > I’m not that familiar with all the config stuff, so I’m looking for > some help to figure out this problem, and I can send you any > additional information which may be needed. > > Here is a test I ran which shows all the steps SA takes to filter > email (spamassassin -D < sample-spam.txt) : > http://web56.net/reference/spamassassin-test.html Did you even have a look at that output yourself? > Here is a list of files in each of my SA folders as well as some of > the config files: http://web56.net/reference/spamassassin-config.html By just a quick glimpse, I spottet a few issues with your config... # Enable or disable network checks skip_rbl_checks 1 use_razor2 1 use_dcc 1 use_pyzor 1 Note that "1" is not always the best choice, and does not mean "enable" but "yes"... ;) Also, you obviously want Razor, Pyzor and DCC. However, setting the options in local.cf is not sufficient. From your debug output: [18696] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC [18696] dbg: razor2: razor2 is not available [18696] dbg: pyzor: pyzor is not available: no pyzor executable found [18696] dbg: pyzor: no pyzor found, disabling Pyzor [18696] dbg: dcc: dccifd is not available: no r/w dccifd socket found [18696] dbg: dcc: dccproc is not available: no dccproc executable found [18696] dbg: dcc: dccifd and dccproc are not available, disabling DCC The Bayes DB failure seems strange, too. > I noticed a few vXXX.pre files, should I erase the older ones, or > does it execute them all together? Nope, don't delete them. guenther -- char *t="[EMAIL PROTECTED]"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}