Topic: Server email overload - goes out of control

[NaN]

I'm running 6.01 for a small office but it needs to handle quite a high volume of email traffic. The traffic is mostly virus hits and spam so I have installed clamav and spamassassin. The whole set-up works really well under normal conditions. Yesterday, however, my service provider was down for about 6 hours and when the service resumed I was deluged with a backlog of email. This swamped the server and caused it to spiral out of control. It seems that new perl processes for scanning the incoming emails were being spawned faster than the incoming emails could be scanned. The result was more and more processes consuming more and more RAM. Then the machine started to swap and from there it was downhill. I turned off the Internet feed and after some time it recovered and caught up with the flow.

Admittedly my machine is fairly lightweight (PIII-550, 256MB RAM, SCSI HD), but is there any way to limit the numer of processes spawned for spam and AV scanning? I'd prefer email took longer to get through the queue in return for peace of mind that it won't go out of control again.  

TIA
David.

[raem]

I had the same thing happen on a server with a PIII 333/256Mb when I upgraded to v6.0.
I would sugest doubling the RAM would be a good start.
Spamassassin (& virus scanning) is processor/memory intensive and your box is underpowered for peak loads.
You could disable Spamassassin, this is not as silly as it sounds if you read below.

Also try these for a good way to reduce load on the system. These methods will reject spam & virus infected attachments at the incoming mail server.

Spam blocking using smtpfront-qmail
See my new howto
http://forums.contribs.org/index.php?topic=21865.0

Executable content blocking using smtpfront-qmail
See
http://lists.contribs.org/mailman/public/devinfo/msg07431.html
Be sure to read all the posts as Gordon Rowell has released beta rpms now and these work quite well, nothing beta about them.
I'm planning to put a HOWTO together in the next few days.

Implementing both of the above have reduced my virus detections to virtually zero (ie 1 in a week compared to hundreds previously) and spam reduced by about 90-95% compared to previously.

Regs
Ray

[NaN]

Thanks for the tips Ray, I'll give them a try and see how I get on.

Cheers
David.

[allun]

Ray,

Just letting you know that a HOWTO would be much appreciated - and I'm sure I'm not the only one!  

[len_chan]

Sorry to revive old threads... but...

Is there anyone out there who knows how to limit the number of scanning processes spawned (and cares to share?).  I have to assume that there is one, but I don't know where to begin to look for such an option!

The smtpfront-qmail for executables looks interesting, but it wouldn't help if it is all legitimate email.

I DOS'd my poor little home server today when I was testing a script... apparently it didn't appreciate getting 150 emails within a couple seconds.  =)  Then after 30 minutes of disk-thrashing, it seems that it also dropped about 120 of those messages... hmmm.

I'm running the Custom 6.01 that was/is floating around - so on th email side, I've got amavis and clamd running (I think).

Any hints are greatly appreciated!

Leonard

[smeghead]

Try

/sbin/e-smith/db configuration setprop qmail ConcurrencyRemote 20
/sbin/e-smith/db configuration setprop qmail ConcurrencyLocal 10
/sbin/e-smith/signal-event email-update
/etc/init.d/qmail restart

HTH

[len_chan]

smeghead,

Thanks! That almost worked completely.  For some reason ConcurrencyLocal wasn't being set or used properly; however, I just created a custom template fragment to set it.  It was easy once I knew where to look. So far, so good.

[mbachmann]

That's exactly what happens here once a week. And i have seen some <pyzor> defunct subprocesses from spamassassin on ps -AH alongside with that.