[Mimedefang] mimedefang -> tcp/ip -> clamav

[Stephen J Smoogen]

Muhammad Talha wrote:
>>>Is there a possibility to run clamd over a tcp socket.
>>
>>Even if there is, it still needs file system access to the
>>/var/spool/MIMEDefang directory, so it has to run on the local host.
> 
> 
> What if  we mount /var/spool/MIMEdefang on remote machine through NFS
> 


I think (but am probably wrong, the socket file has to be on the machine 
that you are running clamav and mimedefang on. It cant just be mounted 
via NFS. However even if I am wrong, you would find your slowdown even 
worse... as you are now dealing with multiple network bottlenecks.

As it is, /var/spool/MIMEdefang should be on the FASTEST available 
'drive', be it a memory drive, a hardware memory drive, or worse case 
the only drive on a dedicated SCSI bus in the fastest PCI slot you got. 
/var/spool/mqueue/xf/ should also be in a similar state.

Take some time and try to analyze the box a bit. What is using the most 
memory. what is using the most interrupts on the bus, what is using the 
most CPU, etc. Move that to dedicated hardware where possible. Spread 
your mqueus over multiple hard-drives and disk buses.

My bet is that the problem is the DCC-server/spamassassin. If you have 
multiple machines that you can do this with.. spread the load with 
multiple Mailrelays acting as your MX record or worse yet, set up one 
box that just does clamav and who sends all its email to the box that 
does spamassassin/DCC.



-- 
Stephen John Smoogen		smoogen at lanl.gov
Los Alamos National Lab  CCN-5 | PH: 4-0645
Ta-03 SM-1498 MailStop B255 DP 10S  Los Alamos, NM 87545