Matias Lopez Bergero wrote: > Bowie Bailey wrote: > > Matias Lopez Bergero wrote: > > [...] > > > Looks to me that SpamAssassin is taking to long to process the > > > incoming emails, and as result, it is slowing down the server, and > > > finally causing the DoS. > > [...] > > > > The message about increasing the child processes is frequently > > misleading. You may not have enough memory to deal with the > > children you already have. Run 'top' and see how much memory your > > child processes are using. > > How may I calculate the amount of children that I should be running?
Trial and error... Take the amount of available memory when spamd is not running and divide by 65MB. That will give you a starting point. If you still have problems with swapping, reduce it more. > > If each child is more than 50-60MB, you probably have an add-on > > ruleset that is causing the problem. sa-blacklist, > > sa-blacklist-uri, and bigevil are the most common contributors to > > this problem. Remove them, restart spamd, and see what happens. > > The spamd processes are using about 61-62MB, but I have seeing them > with a fewer usage. I have none of that rulesets that you have > mentioned. > > > If the children are a reasonable size, then you may simply have too > > many of them running. Take a look at your memory usage when the > > system gets slow. If you are using all of your memory, you need to > > reduce the number of child processes. Once your machine starts to > > swap, SA will run VERY slowly. A fewer number of fast processes > > will do better than a large number of slow ones. > > I have seeing just around to 600K of swap use. Do I need to be > worried? With 600K of use, it doesn't sound like SA is swapping out. Watch 'top' on the server when it starts having problems. If you see very little CPU usage and lots of disk activity, you are probably having swapping problems. If not, the problem is most likely elsewhere. > > For more info on speeding up SA, take a look at the wiki: > > > > http://wiki.apache.org/spamassassin/FasterPerformance > > Thank you. -- Bowie
