[Mimedefang] Dramatic Slowdown in SpamAssassin?

[Stefan Schoeman]

Hi Everyone,

I have experienced a sudden significant slowdown in SpamAssassin 
processing via MIMEDefang that I would really like to run by the list 
membership for opinions.

I have a few boxes configured with MD,SA and ClamAV. On 2 of the boxes, 
the SA Scans have suddenly jumped to taking between 6 and 10 seconds. 
This is up from the normal scan time of around 0.3 to 2 seconds. The 
funny thing is, nothing has changed in terms of hardware or 
configuration, and the RAM usage is pretty much the same as it has 
always been. CPU usage is higher, but not so that one starts worrying. 
More significantly, my sendmail is starting to refuse
messages on too many connections because the emails are taking too long 
to process (3 x longer than before).

I have tried multiple things to solve this. First, I have trimmed all my 
custom SA rules. Next, since SA uses a lot of DNS-based services, I have 
tested this against totally different DNS Servers. I've even upgraded SA 
to 3.2.3 and Net::DNS on one of the boxes. None of these seem to make 
any real difference, the scan times remain at around 6 seconds for the 
spam_assassin_check() call.

What makes these 2 boxes different from others that I have? Well, most 
of my boxes are Slackware, but these 2 are CentOS 4. And they are 
located in the USA, while my others are in the UK and across Africa. The 
CentOS boxes are not on the same network either, so while I could 
suspect a networking issue, all other services (like httpd) run 100% 
normally. I also have the RAMDisk for /var/spool/MIMEDefang and it seems 
to working fine, although it gets a bit fuller with the amount of time 
that mails now stay in the RAMdisk.

Has anyone else perhaps experienced something similar, or does anyone 
have any additional suggestions on why my SA scan times would suddenly 
jump to 3 x their normal duration?

Looking forward to you input.

Stefan Schoeman