paul.mcilfatrick@??? escribió:
>>> As the part-time admin of an MTA I would appreciate some advice on
>>> what values to use for Exim's parameters to stop throughput reducing
>>> to a trickle.
>> [snip]
>>> About 99% of all our e-mails arrive from two company edge servers and
>
>>> total received is about 20,000 e-mails per day with only around 1,000
>
>>> of genuine e-mails and the rest being SPAM.
>> [snip]
>>> Arriving in this morning I issued the top command and it showed 13
>>> exim-4.63-4 processes, all sleeping, and only 0.4% user cpu usage
>>> (this is usually more than 50%).
>> [snip]
>
>> Do you have many many messages in your queue (exim -bpc)? Are you
>> trying to bounce those 20000 spam emails (exim -bp)? Can you verify
>> in the log file that new queue runners are being spawned? What does
>> exiwhat tell you those processes are doing? Is clamd/spamd still
>> running and responding to a PING on the socket?
>
> No messages were in the queue and the mainlog shows that the queue
> runners were starting every 5 minutes but ending immediately.
>
> I have ACLs set up to remove as many e-mails as possible but all that
> remain are passed through SpamAssassin (sa-exim). All e-mails with a
> SpamAssassin score of 5.0 or over is not delivered but put in directory
> for 10 days before being deleted.
>
> My suspicions are that the problem is to do with SpamAssassin's Bayesian
> engine as I do a sa-learn of around 1000 SPAM submitted by users at the
> start of each month. The problem of performance started around 3 or 4
> months ago probably when some SPAM threshold was reached and it has been
> getting worse ever since.
Sometimes bayes_auto_expire setting causes that behavior, though you
should get a hint on your maillog about it. A message that's auto
learned can trigger the expiration process, which will lock the database
and put the other processes on hold. Setting it to 0 and doing a
'sa-learn --force-expire' when you have the fewer traffic/load usually
helps.
> Yesterday I set up the mailhost Solaris box to reboot every evening and
> I will monitor how the system performs.
--
Angel Marin
http://anmar.eu.org/
