Re: Help figuring our why SA is taking like 1.5 minutes to filter...

[Karsten Bräckelmann <gu...@rudersport.de>]

On Thu, 2007-10-25 at 09:23 -0400, Joey wrote:

> I have a situation where CPU is just going through the roof on just a
> few messages and I really can’t tell what part of SA is the slow down.

Since this happens for a few messages only, I would start by checking if
these messages got something in common. Also, scanning really large
messages can result in such an issue. How do you call SA? Is there and
maximum message size for scanning in your mail chain, or do you
unconditionally scan everything? Do these messages by any chance happen
to be large?

Throwing a huge list of REs at SA can have such an impact, too. An idea
would be, to remove them and observe. Then, if the problem went away,
put them back in one by one, and keep observing until you find the
offender.

As Jeff pointed out already, you should not be using blacklist.cf since
it is obsoleted by an RBL (which you actually use). With >20M (!) this
would the first ruleset I'd remove in case of anything smelling fishy
anyway...


> I’m not that familiar with all the config stuff, so I’m looking for
> some help to figure out this problem, and I can send you any
> additional information which may be needed.
> 
> Here is a test I ran which shows all the steps SA takes to filter
> email (spamassassin -D <  sample-spam.txt) :
> http://web56.net/reference/spamassassin-test.html

Did you even have a look at that output yourself?

> Here is a list of files in each of my SA folders as well as some of
> the config files: http://web56.net/reference/spamassassin-config.html

By just a quick glimpse, I spottet a few issues with your config...

 # Enable or disable network checks
 skip_rbl_checks 1
 use_razor2 1
 use_dcc 1
 use_pyzor 1

Note that "1" is not always the best choice, and does not mean "enable"
but "yes"... ;)

Also, you obviously want Razor, Pyzor and DCC. However, setting the
options in local.cf is not sufficient. From your debug output:

 [18696] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC
 [18696] dbg: razor2: razor2 is not available

 [18696] dbg: pyzor: pyzor is not available: no pyzor executable found
 [18696] dbg: pyzor: no pyzor found, disabling Pyzor

 [18696] dbg: dcc: dccifd is not available: no r/w dccifd socket found
 [18696] dbg: dcc: dccproc is not available: no dccproc executable found
 [18696] dbg: dcc: dccifd and dccproc are not available, disabling DCC

The Bayes DB failure seems strange, too.


> I noticed a few vXXX.pre files, should I erase the older ones,  or
> does it execute them all together?

Nope, don't delete them.

  guenther


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}