This is a discussion on Re: Spamassassin+amavis - SpamAssassin ; Luis, > I was doing some tests with all the recommendations you sent me... > and I can make to work the server correctly... I was filtering spam with > no problems and my performances troubles dissapeard... > > I ...
> I was doing some tests with all the recommendations you sent me...
> and I can make to work the server correctly... I was filtering spam with
> no problems and my performances troubles dissapeard...
> I just configured 5 procs for amavis and postfix content filter and
> I turn off the network tests... the server can filter a lot of spam and
> delivery quickly... but now appears another problem
With your 4 CPU 4 GB mem box you should be able to run more than 4
amavisd(+SA) processes. As a rule of a thumb, I'd say your box should
not have trouble running 20..30 processes.
> Until today morning... I was filtering and deliverying fine, but
> suddenly I received these messages and the delivery is sooo slow and
> the mail queue just is growing and growing....
> Nov 5 12:51:23 mailgw postfix/qmgr: warning: mail for
> [127.0.0.1]:10024 is using up 4001 of 4004 active queue entries
This is just a consequence of your amavisd+SpamAssassin not being able
to keep up with the incoming mail flow. No fine tuning on the Postfix
side will be able to compensate for the fact that your mail inflow rate
is larger than the mail processing throughput of SpamAssassin filtering.
What is your message rate on a normal day? Is the current mail flow
significantly larger? Perhaps you are under a bounce storm, which can
easily increase the mail flow rate by an order of magnitude. Examine
what kind of messages are most typical in your mail queue (mailq, postcat),
try to determine if these are just normal spam flow, or bounces, or
something else (e.g. mailer abused as an open relay, perhaps by one of
your client PCs which might have been zombiized).
What is the message throughput though the filter - see what amavisd-agent
has to report, the more interesting figures are for example:
CacheAttempts 15216 3217/h 100.0 % (CacheAttempts)
CacheHits 1750 370/h 11.5 % (CacheAttempts)
InMsgs 15216 3217/h 100.0 % (InMsgs)
InMsgsBounce 4176 883/h 27.4 % (InMsgs)
InMsgsBounceKilled 3904 825/h 93.5 % (InMsgsBounce)
How does the display of amavisd-nanny look like? Are all processes
about evenly busy? Are processing times significantly longer than a
couple of seconds? Set $nanny_details_level=2; (in amavisd.conf) for
more detailed timing breakdown by amavisd-nanny.
Check timing log (at log level 2), you may want to (re)confirm that
SpamAssassin is really taking most of the time, just in case.
> -I turned off DCC, Razor and Pyzor.
> -I set the bayes use to 0.
These were pretty drastic measures, significantly affecting quality
of SA results. Once you get over the current crisis, at least put back
the DCC and Bayes on MySQL, which are relatively low resource consumers
compared to regexp-based rules and to Pyzor (razor is somewhere inbetween).