[SA-exim] Re: [Exim] EXIM 4.31, courier-imap, Clamd, exiscan, spamassassinLoad problems

[Tor Slettnes]

On May 10, 2004, at 15:19, Doug Block wrote:
> Well I am using a AMD XP200+ yes I know it's not a server chip but it 
> was
> what I had free at the time.  I have Sa-scan handling the Spamassassin 
> and
> exiscan handling the clamd.

You probably mean "SA-Exim", not "SA-Scan".  SA-Exim has problems with 
Exim v4.31 through 4.33, due to the Received: header change.  Either 
stay with 4.30, or upgrade to 4.34, or you will get wildly inaccurate 
SA scores (specifically, SA-Exim may trust forged Received: headers, or 
else treat messages sent through a smarthost as if they came directly 
from a dialup host).

That, though, probably has nothing to do with your load issues.

> I have about 80 power users that receive anywhere between 4k to 10k of 
> msgs
> per day.  The box I currently have for them is  1.5 gig 1024 meg  RH9 
> box
> with a Ide OS drive for RH9 with all of the mail related items stored 
> on a
> hardware mirrored 73 gig scsi320 drives (/home, /mail /var/spool, 
> etc).  So
> far have migrated about 7 gig of mail in maildir format over for about 
> 30
> users and I have notice that my proc is spiking (which is normal) but 
> my
> users are noticing a delay in Imap response which I think is due to the
> spike to 100% for spamd and clamd when a ton of mail comes thru.

Well, for starters, Courier is not exactly the fastest IMAP server out 
there.  Something like Cyrus (or even DoveCot) will definitely give 
faster access, especially for large mailboxes and many users.

That said, IMAP access to a newly Courier folder will speed up after 
the first time.  Initially, Exim (and other 3rd party tools that drop 
mails in Maildir/ hierarchies) place stuff in the "new/" subfolder, 
unindexed.  Once Courier has had a chance to move the new mail into 
"cur/" and to index it, you will see that the mailbox can be opened 
faster.


In your case, a bigger problem may be SpamAssassin itself.  Don't allow 
it to scan very large mails (e.g. >256k).  I believe SA-Exim's 
configuration file has a maximum message size setting; correct me if I 
am wrong.  Or else, in Exim you can set an ACL condition on 
$message_size.

-tor