Monky wrote: > Hallo list, > receiving a bunch of obvious spam emails without the SA tags in it > made me look at my logfiles and I found out - thats what I guess - > that for a short time my server was reaching his limits. > Short grep extracts from my logfile:
> Mar 21 11:14:48 h1306680 spamd[9247]: prefork: child states: BBBBB > Mar 21 11:15:31 h1306680 spamd[9247]: prefork: server reached > --max-children setting, consider raising it > Mar 21 11:11:48 h1306680 spamd[3550]: spamd: identified spam > (32.3/5.0) for popuser:110 in 373.2 seconds, 17910 bytes. > Mar 21 11:12:47 h1306680 spamd[30139]: spamd: identified spam > (14.8/5.0) for popuser:110 in 412.3 seconds, 4164 bytes. > What I make of this is that when my server is using his maximum of 5 > spamd children he hits the RAM limit and starts paging (the explosion > of scanning time). Is this a sensible assessment? > > What could I do about it? Raising --maximum-children seems not a good > idea. Actually it seems wiser to reduce to a maximum of 4 children. > How can I prevent spam from passing my system unchecked due to a > (temporary) overload? If I look at the prefork child states the > critical time is followed by hours of II / BI. How could I queue the > incoming emails and ensure that every email gets scanned? > Currently I am using qmail's defaultdelivery setting: > > spamc | /usr/bin/deliverquota ./Maildir > Additionally some users use procmail to filter spam. > > Any hints and help appretiated! Your assessment sounds right to me. I would make two suggestions. 1) Memory is cheap these days. Add some more RAM. 2) Reduce the maximum children setting so that the system doesn't start swapping. This will cause SA to scan faster and should result in fewer messages slipping through while SA is busy. -- Bowie
