[Mimedefang] High CPU Utilization

[Nels Lindquist]

On 5 Mar 2003 at 15:56, Michael Pellegrino wrote:

> Pentium II, 256MB Ram, MD 2.30, SA 2.50, clamd 2.54, SPOOLDIR resides on a
> RAM Disk, server does maybe 1000-1200 messages per day tops.  10 min slaves,
> 30 max.  timeout 90, busy timeout 300.  Suse Linux 8.1 (2.4.19).
> 
> We occasionally have brief spikes in email traffic, about 20-30 messages
> over a 2-4 minute time period.  These are rare, but were never a problem
> until recently.  We will get a few "ERR Filter timed out - system may be
> overloaded" messages along with a lot of rejected emails (Milter:  data,
> reject=451 4.7.1 Please try again later).

Yes; we see these spikes as well.  Sadly, they're almost always a 
flood of spam--most often Nigerian scams for some reason.

> Any thoughts?  I could easily upgrade the server, but for the volume of
> email this system should be just fine.  It just seems to me that the CPU
> utilization on the mimedefang processes is a bit high.

We're seeing this, too.  I strongly suspect that SA 2.50 is the 
problem.  Which options are you using with SA?  Bayes?  Any network 
tests? DCC/Razor2?

We've got a similar setup, only with 128MB but no ramdisk.  How large 
is your ramdisk?  During one of the "floods," I ran vmstat and 
noticed a *lot* of swap activity; I suspect our machine could use 
some more memory.

----
Nels Lindquist <*>
Information Systems Manager
Morningstar Air Express Inc.