Delays in message processing

[Roman Serbski <me...@gmail.com>]

Hi list-

We have been facing with delays in message processing for a couple of
days already. It usually takes 7-12 seconds to check the message but
now it takes ~30 seconds with some spam messages passing through
(scored as SA:0(?/?) which means some checks were timed out).

SA 3.2.3, called by qmail-scanner-st-2.01st [20070204], is running on
FreeBSD 6.2-STABLE.

Here is my local.cf:

required_hits 5.5
skip_rbl_checks 0
dns_available yes
add_header all DCC _DCCB_ _DCCR_ Status "_YESNO_, hits=_HITS_
required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_"
trusted_networks 192.168.0.
lock_method flock

use_bayes 1
bayes_path /var/spool/spamd/.spamassassin/bayes
bayes_file_mode 0666
bayes_min_ham_num 150
bayes_min_spam_num 150
bayes_auto_expire 0

bayes_auto_learn 1
bayes_auto_learn_threshold_nonspam 1.1
bayes_auto_learn_threshold_spam 8.2

use_auto_whitelist 0
auto_whitelist_path /var/spool/spamd/.spamassassin/whitelist
auto_whitelist_file_mode 0666

use_dcc 1
dcc_path /usr/local/bin/dccproc
dcc_home /usr/local/dcc
dcc_options -x 0
dcc_timeout 10

use_pyzor 1
pyzor_timeout 60
pyzor_options --homedir /usr/local/etc/mail/spamassassin

use_razor2 1
razor_timeout 60
razor_config /usr/local/etc/mail/spamassassin/.razor/razor-agent.conf

I also use rblsmtpd running checks on sbl-xbl.spamhaus.org,
bl.spamcop.net, dul.dnsbl.sorbs.net and t1.dnsbl.net.au.

The delay is around 30 seconds for *some* messages. I can't figure out
what is causing it.  I've faced with such "delayed" messages before
but it was 1-2 message per month and spam only. Now it's quite a lot
during a day for any messages. At the same time, there are messages
being processed fast enough.

I tried to disable razor/pyzor/dcc and turn off RBLs - it had no
effect. I suspect some DNS checks are timing out but can't find which
one. We have plenty of bandwidth available, and as far as I can see no
problems with DNS. No errors reported by spamassassin -D --lint. The
only error(?) I see comes from dnscache:

@4000000046f24dfe37181e4c servfail
33.20.65.165.combined-hib.dnsiplists.completewhois.com. input/output
error
@4000000046f24dfe3719b874 servfail
45.35.65.165.combined-hib.dnsiplists.completewhois.com. input/output
error

but I'm not quite sure where this check comes from?

Anyone with the similar symptoms? Any advise would be greatly appreciated.

Thank you.

RE: Delays in message processing

["Randal, Phil" <pr...@herefordshire.gov.uk>]

Do an sa-update without delay.

The rulesets were updated yesterday and the completewhois rules removed.
They were causing DNS timeouts.

Cheers,

Phil

--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: Roman Serbski [mailto:mefystofel@gmail.com] 
> Sent: 21 September 2007 10:42
> To: users@spamassassin.apache.org
> Subject: Delays in message processing
> 
> Hi list-
> 
> We have been facing with delays in message processing for a couple of
> days already. It usually takes 7-12 seconds to check the message but
> now it takes ~30 seconds with some spam messages passing through
> (scored as SA:0(?/?) which means some checks were timed out).
> 
> SA 3.2.3, called by qmail-scanner-st-2.01st [20070204], is running on
> FreeBSD 6.2-STABLE.
> 
> Here is my local.cf:
> 
> required_hits 5.5
> skip_rbl_checks 0
> dns_available yes
> add_header all DCC _DCCB_ _DCCR_ Status "_YESNO_, hits=_HITS_
> required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_"
> trusted_networks 192.168.0.
> lock_method flock
> 
> use_bayes 1
> bayes_path /var/spool/spamd/.spamassassin/bayes
> bayes_file_mode 0666
> bayes_min_ham_num 150
> bayes_min_spam_num 150
> bayes_auto_expire 0
> 
> bayes_auto_learn 1
> bayes_auto_learn_threshold_nonspam 1.1
> bayes_auto_learn_threshold_spam 8.2
> 
> use_auto_whitelist 0
> auto_whitelist_path /var/spool/spamd/.spamassassin/whitelist
> auto_whitelist_file_mode 0666
> 
> use_dcc 1
> dcc_path /usr/local/bin/dccproc
> dcc_home /usr/local/dcc
> dcc_options -x 0
> dcc_timeout 10
> 
> use_pyzor 1
> pyzor_timeout 60
> pyzor_options --homedir /usr/local/etc/mail/spamassassin
> 
> use_razor2 1
> razor_timeout 60
> razor_config /usr/local/etc/mail/spamassassin/.razor/razor-agent.conf
> 
> I also use rblsmtpd running checks on sbl-xbl.spamhaus.org,
> bl.spamcop.net, dul.dnsbl.sorbs.net and t1.dnsbl.net.au.
> 
> The delay is around 30 seconds for *some* messages. I can't figure out
> what is causing it.  I've faced with such "delayed" messages before
> but it was 1-2 message per month and spam only. Now it's quite a lot
> during a day for any messages. At the same time, there are messages
> being processed fast enough.
> 
> I tried to disable razor/pyzor/dcc and turn off RBLs - it had no
> effect. I suspect some DNS checks are timing out but can't find which
> one. We have plenty of bandwidth available, and as far as I can see no
> problems with DNS. No errors reported by spamassassin -D --lint. The
> only error(?) I see comes from dnscache:
> 
> @4000000046f24dfe37181e4c servfail
> 33.20.65.165.combined-hib.dnsiplists.completewhois.com. input/output
> error
> @4000000046f24dfe3719b874 servfail
> 45.35.65.165.combined-hib.dnsiplists.completewhois.com. input/output
> error
> 
> but I'm not quite sure where this check comes from?
> 
> Anyone with the similar symptoms? Any advise would be greatly 
> appreciated.
> 
> Thank you.
>