spam leaks, high server load!?

[Christian Stalberg <we...@web-analysts.net>]

Spamassassin is using a lot of resources, in particular,
high CPU for spamd running as one of my users. I am 
now seeing spam leak through. I have replaced the spamd
option '-m5' with '--round-robin' in my start up script to
no effect. Other users demand for spamd appears normal.
I am using RulesDuJour and SARE rulesets. What would 
cause this problem and what can I do about it? Thank you
in advance!

setup: SA 3.2.2 w. procmail & Sendmail on fedora core 5

Re: spam leaks, high server load!?

[Matthias Leisi <ma...@leisi.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Diego H. schrieb:

> If anyone suggest to remove some SA plugin from  v310.pre, v312.pre or
> v320.pre would be nice.
> Maybe one of this plugins is pushing the load too, If anyone recommend to
> turn it off, I would like to hear comments:
> 
> Perform DCC checks
> Perform Pyzor checks
> Perform Razor2 checks

I don't run any of these and don't have the urge to enable them. The
other rules (including Bayes) work fine with me.

> Perform Spamcop reporting
> Perform AWL checks

How big is your AWL file? It's not maintained automatically as the Bayes
files and can become *really* huge if not maintained manually (through
scripts).

> AutoLearnThreshold
> WhiteListSubject
> MimeHeader
> ReplaceTags
> URIDNSBL

These are all core features which I would not remove.

> HashCash

How many hits does this give you?

> SPF

How much value does this offer to you? I have found the actual use of
SPF to be rather limited, but YMMV.

> ImageInfo

I don't use ImageInfo, and have little to no image spam coming through
(thanks to Bayes and RBLs), and I understand it is pretty CPU intensive.

> VBounce

Same as for ImageInfo, but I don't know how much additional load it causes.

> Bayes
> BodyEval
> [..]

The remainder of the plugins you listed are core features which I would
not want to miss. If you are *really* tight on resources, you may
disable Bayes, but doing so will noticeably decrease the ratio of
detected spam and may increase the number of false positives at the same
time.

Other things to check:

* Do your DNS queries time out (it may be that your DNS server is
limiting the number of concurrent recursive queries it is willing to
handle)?

* What is the maximum size of messages you pass through SA? 256K seems
to be a good upper limit.

* Is your machine swapping / low on memory, is it CPU, ...

* What additional rulesets (SARE?) do you use?

- -- Matthias
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFGut1TxbHw2nyi/okRAm5tAJ9SJ3qATzFGpyCce5IkMqZA1HssUQCguzR4
X+M7bCobqpn82mm/jRMJdUw=
=yUSd
-----END PGP SIGNATURE-----

Re: spam leaks, high server load!?

["Diego H." <dd...@unarea.com>]

Which MTA are you using? Exim? Well I had the same problem last month and
everything got fixed when I limited the message scan size to 80k.

SA was sacanning everything even 10mb messages so I reduced the scan to 80K
by adding a rule to exim.conf.

Now I dont see spikes at all. Load is around 3 now and spamd child process
are 30mb in size each one.

If anyone suggest to remove some SA plugin from  v310.pre, v312.pre or
v320.pre would be nice.
Maybe one of this plugins is pushing the load too, If anyone recommend to
turn it off, I would like to hear comments:

Perform DCC checks
Perform Pyzor checks
Perform Razor2 checks
Perform Spamcop reporting
Perform AWL checks
AutoLearnThreshold
WhiteListSubject
MimeHeader
ReplaceTags
URIDNSBL
HashCash
SPF
ImageInfo
VBounce
Bayes
BodyEval
DnsEval
HTMLEval
HeaderEval
MIMEEval
RelayEval
URIEval
WLBLEval
URIDetail
HTTPSMismatch
Check






Webmaster-163 wrote:
> 
> Spamassassin is using a lot of resources, in particular,
> high CPU for spamd running as one of my users. I am 
> now seeing spam leak through. I have replaced the spamd
> option '-m5' with '--round-robin' in my start up script to
> no effect. Other users demand for spamd appears normal.
> I am using RulesDuJour and SARE rulesets. What would 
> cause this problem and what can I do about it? Thank you
> in advance!
> 
> setup: SA 3.2.2 w. procmail & Sendmail on fedora core 5
> 
> 

-- 
View this message in context: http://www.nabble.com/spamassassin-gets-stucked-in-tf4206163.html#a12051965
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.