[Mimedefang] Over 6 min delay before passing messages?

[Matt Bruce]

Hi all,

This is my first posting to the list, so please excuse me if this
question has been covered already. I've spent much of the afternoon
trawling through the list archives, but have been unable to see the same
kind of problem.

I am currently configuring my first MIMEDefang installation to act as an
SMTP anti-virus/-spam gateway. It has an MX record configured and the
mail handling all flowsas expected, but there are delays averaging just
over 6 minutes between the gateway accepting the message from the
Internet and passing it into the network's mail server. The SMTP
connection shows no delay - accepts the '.' DATA terminator and QUIT
quickly, and writes the first entry in /var/log/maillog immediately - so
it implies it's something higher up in the processing stack.

The specs are a Pentium-II (>128MB), Linux RedHat 7.2, Sendmail 8.12.6,
MIMEDefang 2.26, SpamAssassin 2.43 (Mail::SpamAssassin), Anomy Sanitizer
1.57, Clam AV 0.54 (clamd), F-Prot for Linux, MIME-tools 5.411a (RP
patched version), Vipul's Razor 1.20 and all the relevant CPAN files and
upgrades.

Here's the kind of log entry I'm reguarly seeing (sanitised domains and
IPs):

Jan  6 16:45:54 hostname sendmail[7311]: h06Gjrn0007311:
from=<me at somewhere.com>, size=1377, class=0, nrcpts=1,
msgid=<004f01c2b5a2$fc24e140$030110ac at somedomain.com>, proto=ESMTP,
daemon=MTA, relay=mx1.our-isp.com [10.18.248.75] (may be forged)
Jan  6 16:52:14 hostname sendmail[7317]: h06Gjrn0007311:
to=fred at ourdomain.com, delay=00:06:20, xdelay=00:06:18, mailer=esmtp,
pri=61619, relay=mx.our-isp.com. [10.18.248.75], dsn=2.0.0, stat=Sent
(h06GqGk1023090 Message accepted for delivery)

It's not the RBL or Razor checks (though I do get "IO::Socket::INET:
Timeout" errors when I have it enabled), and the Sendmail side seems to
be working okay (starts with "SMTP+queuing at 01:00:00")

The relevant sendmail.mc entry is:

INPUT_MAIL_FILTER(`mimedefang',
`S=unix:/var/spool/MIMEDefang/mimedefang.sock, F=T, T=S:5m;R:5m')

The S: and R: options give the same result when set to 1m or 5m, so it
seems unlikely that this is my problem.

As I'm new to MIMEDefang and SpamAssassin, I suspect it may be my
/etc/mail/mimedefang-filter script which I've customised based upon the
resources at the MIMEDefang website. 

Rather than fill the list with script listings, would anyone
able/willing to assist mind dropping me an email so I can send you the
script off-list? Any assistance would be greatly appreciated. Let me
know if you need further information.

Thanks,

Matt Bruce
mbruce at insl.co.uk