[Mimedefang] Re: "Please try again later"

[Paul Murphy]

John,

> A little while later, it came back.  It seemed less frequent, but this 
> is uner a night load, instead of a day load.  So it's hard to tell.  It 
> looks like we're going to have to wait for the hardware upgrade.

Some standard questions:

1.  Do you limit the size of messages submitted to SpamAssassin?  Generally,
anything over about 500K will take forever to scan, and is highly unlikely to
be Spam, so most people skip it.

    # Spam checks if SpamAssassin is installed
    if ($Features{"SpamAssassin"}) {

        if (-s "./INPUTMSG" < 500*1024) {
            # Only scan messages smaller than 500kB.  Larger messages
            # are extremely unlikely to be spam, and SpamAssassin is
            # dreadfully slow on very large messages.
            my($hits, $req, $names, $report) = spam_assassin_check();  

2.  Do you do Spam checks on outgoing mail?  Again, many sites work on the
assumption that their outgoing mail is highly unlikely to be spam, so they
don't scan it.  If one of their users is showing abnormal numbers of
messages, they'll notice and investigate.

3.  Do you run multiple virus scanners in serial/parallel over all messages?
If so, you might want to consider how effective this is, since generally
running two reliable scanners is the ideal trade-off between performance and
effectiveness.  Personally, I trust Clamav implicitly, and if I have to use a
second high-profile scanner, I'd pick one of the main commercial scanners.

4.  Have you tuned your Solaris system for best performance as a mail server?
Out of the box, the number of cached inodes and UFS handles used by Solaris
can be fairly crummy, so monitoring the box using tools such as the SE
toolkit (if its available for your version of Solaris) can give massive
increases in performance simply by tuning the OS.

5.  Is your high load due to disk I/O waits, or processor bottlenecks?  The
tempfs suggestion works for most people, but on high loads you may find that
syslog, DBM bayes/awl checks, SQL accesses, etc are also being delayed by
slow or overloaded disks, so you may want to rethink how you handle these.

Best Wishes,

Paul.