Marcin Mirosław wrote:
W dniu 30.03.2011 15:47, Per Jessen pisze:
Yes, I meant the child - obviously, it sounds as if it's a problem in
the bayes processing. I don't use SA bayes, but that problem ought to
be investigated first before we look at work-arounds. IMHO.
I'm expecting that bayes can do its work for long time, i'm working on
mail with many, many words.
My experience here has been that if a spamd child is pegging a CPU core
for an extended period, there's simply a *lot* of body text to run
(raw)body rules against (eg, ~ >200K).
We've found that a fairly effective defense against this is to set up a
second spamd instance with ~20 high-scoring rules (Spamhaus, local
DNSBL, local and remote URI blacklists, Pyzor and/or Razor, plus one or
two "normal" rules) and do two scanning passes:
-> call the second (lean) instance, skip further filtering if tagged.
This skims off ~80% of the junk (much of which would score >20 points
with the full ruleset) at *very* low CPU usage.
-> call the main instance on all remaining mail
-kgd