SpamAssassin and Amavis (was Re: [sllug-members]: smtp server)

[Knight Walker]

On Mon, 2006-10-30 at 23:02 -0700, rn wrote:
> Not quite SpamAssassin itself but if you've got the system resources 
> amavisd-new (http://www.ijs.si/software/amavisd/) can run multiple 
> child servers to handle SpamAssassin checks on a per-message basis. If 
> you need to, it can also be run on its own server to handle the load 
> more efficiently and provide message filtering for Postfix (I believe 
> Exim as well). 

SpamAssassin itself has a "spamd" server which you can place concurrent
instance limits on (I've normally got mine limited to 5 servers). It's
MUCH faster than calling spamassassin through procmail.  I've thought
about having a small farm of SA servers, but that would require a lot of
work or that the mail server share out the /home partition over NFS (So
the SA's could get the ~/.spamassassin/ folders for each user).

My main problem with Amavis is that it's slow.  Quite often when the
spam surge hits at 4am, Nagios will send me a page saying the mail
server stopped responding, then another page 5 to 10 minutes later
saying it's back up.  I've tried everything I can think of to tweak the
settings to keep this from happening, but to no avail.  I've got a
couple of old boxes sitting around that I could use, but I'm not sure
how to break up the load.

> How much mail do you need to process? Some of the folks using 
> amavisd-new with Postfix are processing fairly large volumes of mail. 
> You may want to peruse the amavis-user mailing list archive to get an 
> idea of the various setups people are using it with: 
> http://sourceforge.net/mailarchive/forum.php?forum=amavis-user .

On a "light" day, we do about 15k messages, with about a 40%
failure/deferred/spam/virus/phish rate.  On heavy days, it's upwards of
65-75k messages with upwards of 50% f/d/s/v/p rate (It got really bad a
couple of weeks ago, but has subsided since then).  This is on a single
AMD 1800 with half a gig of RAM doing
Postfix/Amavisd/Clamav/Spamassassin/Dovecot.

Once I get some time, I'll browse that mailing list. Thanks.

-KW