Hello! I was very happy using SpamAssassin at my email server (Xeon 2.8GHz, 1.5 GB memory, Dual Ultra SCSI HD 73.4GB in RAID 1, Linux 2.4.33)
The last few weeks I have noted (angry users calling me by phone) that the server is really slow. The loadav goes from 1.5 to 12.5; normally is about 3.00. There are only 2500 email boxes at the server. The server is running: Sendmail, SpamAssassin 3.1.5 (using milter-spamc), ClamAV (using clamav-milter), Apache 1.3.x, SquirrelMail, pop3, etc. I have seeing some king of bursts of incoming emails (spam mostly), that it is producing a DoS effect. The server shows a table of ~1700 processes and about ~800 tcp sessions (sendmail and milter-spamc most) during this bursts. This seems to prevent other users from connecting to the server in order to use pop3 or smtp services. I have increased the child processes of spamd, but I was unsuccessfully to reduce this effect(I have seing in the logs a message about the need of increase the spamd childs). Also I tweak the sendmail.cf to easy the connection, but the problem persist. Looks to me that SpamAssassin is taking to long to process the incoming emails, and as result, it is slowing down the server, and finally causing the DoS. Can anyone help me with some ideas to solve this? or to see were exactly is the problem? Do I need to improve my hardware? Thanks. BR, Matias.
