[SA-exim] RE: [Exim] EXIM 4.31, courier-imap, Clamd, exiscan, spamassassinLoad problems

[Doug Block]

Yes your right!!! On the spam and the courier
Oh the sa-exim is working great so far on the scores.  I have had a 75% drop
in spam and I have been using spam pit to check the scores which so far have
been correct on both real mail and spam.  I may upgrade to 4.34 once I get
some time since it came out today.   

I have a older (half the speed) exim 4 box that handled the load for up 150
users with courier-imap with out this problem but it did not have clamd,
sa-exim, exiscan, and spamassassin on it.  This box worked fine for 18
months+ but the virus's and spam where a big problem.  I have spam set to
under 256k but I have been watching this while writing this email and I
notice 8-12 messages at a time coming in and eating 100% of the cpu for
about 5 secs while they get spamd and clamd.  

Is this box to small for this load or should I start buying beer for people
to audit my configs.  I have no problem getting a multi-proc box if that
will solve the problem it maybe extream over kill.



On May 10, 2004, at 15:19, Doug Block wrote:
> Well I am using a AMD XP200+ yes I know it's not a server chip but it 
> was what I had free at the time.  I have Sa-scan handling the 
> Spamassassin and
> exiscan handling the clamd.

You probably mean "SA-Exim", not "SA-Scan".  SA-Exim has problems with Exim
v4.31 through 4.33, due to the Received: header change.  Either stay with
4.30, or upgrade to 4.34, or you will get wildly inaccurate SA scores
(specifically, SA-Exim may trust forged Received: headers, or else treat
messages sent through a smarthost as if they came directly from a dialup
host).

That, though, probably has nothing to do with your load issues.

<...snip..>
Well, for starters, Courier is not exactly the fastest IMAP server out
there.  Something like Cyrus (or even DoveCot) will definitely give faster
access, especially for large mailboxes and many users.

That said, IMAP access to a newly Courier folder will speed up after the
first time.  Initially, Exim (and other 3rd party tools that drop mails in
Maildir/ hierarchies) place stuff in the "new/" subfolder, unindexed.  Once
Courier has had a chance to move the new mail into "cur/" and to index it,
you will see that the mailbox can be opened faster.


In your case, a bigger problem may be SpamAssassin itself.  Don't allow it
to scan very large mails (e.g. >256k).  I believe SA-Exim's configuration
file has a maximum message size setting; correct me if I am wrong.  Or else,
in Exim you can set an ACL condition on $message_size.

-tor


--

## List details at http://www.exim.org/mailman/listinfo/exim-users Exim
details at http://www.exim.org/ ##