[Mimedefang] performance tuning tips

[John Coy]

Hello all,

I hope this issue isn't one of those "dead horse" issues on the
mailing list, but I've done my share of off-list research and
experimentation so I hope to come into this question prepared.

I have a fairly busy mail server which handles maybe 100,000
messages a day.  I'm running Sendmail 8.12.2 on Solaris 8 for
the UltraSparc platform and the latest version of MIMEDefang (MDF).
I'm using the MDF multiplexor and spawning off 15 child processes
with a maximum of 25, with an idle timeout of 5 minutes.

I'm only using MDF for scanning viruses.  I'm using the
message_contains_virus_nai() function to do this.  I then
discard the message if it's infected and send a notification
to the sender.

sub filter_begin {
     if ($SuspiciousCharsInHeaders) {
         action_add_header('X-MDF', mdf_headers(0));
     }
     if ($SuspiciousCharsInBody) {
         action_add_header('X-MDF', mdf_headers(1));
     }

     if (message_contains_virus_nai()) {
         action_notify_sender(virus_notify_sender());
         action_discard();
     }
     else {
         action_add_header('X-AntiVirus', 'Scanned for viruses');
     }
}

The problem I'm having (which I know is well warned in the
documentation) is performance.  I was hoping that the
multiplexor would help avoid some of the speed issues, but
during the peak times my mail server grinds pretty badly.
The load average is high, and it seems it's mostly mimedefang.pl
eating up the processsor time.

I'm writing to ask the general question -- are there specific
things I can tweak to maximize the performance of MDF since
all I want to do is scan for viruses.  Although I'd hate to
ask on this mailing list... are there other approaches to
anti-virus filtering (other than Amavis) that can be used to
accomplish what I want?

Your assistance/feedback is greatly appreciated.


---
John Coy
CTO/VP Network Operations
ANCI/Arkansas.Net