At 6:06 pm +0100 2005/03/25, exim@??? wrote: >ok here more details:
>
>so for the moment all (spamd, clamav and exim) are running on one single
>laptop PIII with 512MB RAM/20GB disk
>it's located in the DMZ on a 100mbit network
>maximum smtp connections are set to 24 where 4 are reserved for exim to
>deliver to the exchange server.
>All runs ok, until some spam servers got awaken
well, then it might help limiting the number of simultaneous
connection from the same IP address.
>All 20 connections stay open, and exim and spamd just eat up the memory
>It also happens that spamd drops the check due to exceeded scan time (240s)
>So at that point the box becomes very slow, no smtp connection are accepted
>anymore and even swap gets full (currently to low = 256mb)
swap smaller then real mem??? doesn't look very sane.
Also, are you really scanning all emails? Don't you stop at RCPT,
rather than waiting after DATA, transactions that are clearly spam?
[based on multiple RBLS/ident calls/obviously faked HELO with your
own domain name/etc]
>
>Eventualy the box restores it's normal condition (can take up to 1 hr) but due
>to this, many real mails are either lost, or arrive hours later.
it's not a box, it's a laptop... and I would never run a server off a
laptop. Possible, yes, but unsafe and a sure recipe to throw away
emails.. and the laptop in a short time.
