Amavisd-new/Postfix plugged queue (Long)

On Tue, 22 Aug 2006, Gary V wrote:

> > FWIW, amavisd/spamassassin caught and either
blocked or flagged 125,667 
> > SPAM messages in 13 hours.
> 
> I'm curious, is 250,000 (accepted) msgs/day normal
traffic for you or
> are you getting hit with a substantial dictionary
attack like some
> others? Do you reject mail to invalid recipients? What
is your system
> load and available memory like? Are you swap thrashing?
Just wondering
> if you need a bigger boat and/or you are wasting what
resources you
> have on traffic you should be rejecting.
> 
> Gary V
> 

Hi Gary,

We've had a pretty large amount of spam traffic for the
last couple of 
years. Right now it's getting larger all the time. Makes
you wonder about 
the viability of email down the road.

CPU loads run in the .85 to 1.40 (under heavy load), swap
isn't being 
used, and there is always at least 50% available memory.

I'm in a budget crunch and sort of have to make do. We've
thought about 
filtering certain IP blocks at our edge router, but that
idea is not very 
attractive to me. I'd rather find the real culprits, tie
them naked to the 
back bumper of an air-conditioned car out in the middle of
the desert and 
have someone drive about 5mph while I look at them out of
the back window 
(drinking an ice-cold beer).

Tom

------------------------------------------------------------
-------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to
make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/
sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Tom wrote:

> On Tue, 22 Aug 2006, Gary V wrote:

>> > FWIW, amavisd/spamassassin caught and either
blocked or flagged 125,667 
>> > SPAM messages in 13 hours.
>> 
>> I'm curious, is 250,000 (accepted) msgs/day normal
traffic for you or
>> are you getting hit with a substantial dictionary
attack like some
>> others? Do you reject mail to invalid recipients?
What is your system
>> load and available memory like? Are you swap
thrashing? Just wondering
>> if you need a bigger boat and/or you are wasting
what resources you
>> have on traffic you should be rejecting.
>> 
>> Gary V
>> 

> Hi Gary,

> We've had a pretty large amount of spam traffic for
the last couple of 
> years. Right now it's getting larger all the time.
Makes you wonder about 
> the viability of email down the road.

> CPU loads run in the .85 to 1.40 (under heavy load),
swap isn't being 
> used, and there is always at least 50% available
memory.

> I'm in a budget crunch and sort of have to make do.
We've thought about 
> filtering certain IP blocks at our edge router, but
that idea is not very 
> attractive to me. I'd rather find the real culprits,
tie them naked to the 
> back bumper of an air-conditioned car out in the middle
of the desert and 
> have someone drive about 5mph while I look at them out
of the back window 
> (drinking an ice-cold beer).

> Tom

That sounds like it is well under control as far utilization
goes. If
fact, your system may be underutilized. If you have 50%
unused memory,
you might increase the number of amavisd-new process
($max_servers and
complimentary maxproc for the smtp-amavis transport). I
would try to
get closer to 75% unused memory. I think this would improve
throughput.
What is your $max_servers at now? How much memory does a
typical
amavisd process use? If you were running at 50MB per
process, and you
had 400MB to play with, I would increase the number by 4 or
5, wait a
while (maybe an hour), and see where you are at again.

Gary V


------------------------------------------------------------
-------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to
make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/
sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Gary wrote:

> Tom wrote:

>> On Tue, 22 Aug 2006, Gary V wrote:

>>> > FWIW, amavisd/spamassassin caught and
either blocked or flagged 125,667 
>>> > SPAM messages in 13 hours.
>>> 
>>> I'm curious, is 250,000 (accepted) msgs/day
normal traffic for you or
>>> are you getting hit with a substantial
dictionary attack like some
>>> others? Do you reject mail to invalid
recipients? What is your system
>>> load and available memory like? Are you swap
thrashing? Just wondering
>>> if you need a bigger boat and/or you are
wasting what resources you
>>> have on traffic you should be rejecting.
>>> 
>>> Gary V
>>> 

>> Hi Gary,

>> We've had a pretty large amount of spam traffic
for the last couple of 
>> years. Right now it's getting larger all the time.
Makes you wonder about 
>> the viability of email down the road.

>> CPU loads run in the .85 to 1.40 (under heavy
load), swap isn't being 
>> used, and there is always at least 50% available
memory.

>> I'm in a budget crunch and sort of have to make
do. We've thought about 
>> filtering certain IP blocks at our edge router, but
that idea is not very 
>> attractive to me. I'd rather find the real
culprits, tie them naked to the 
>> back bumper of an air-conditioned car out in the
middle of the desert and 
>> have someone drive about 5mph while I look at them
out of the back window 
>> (drinking an ice-cold beer).

>> Tom

> That sounds like it is well under control as far
utilization goes. If
> fact, your system may be underutilized. If you have 50%
unused memory,
> you might increase the number of amavisd-new process
($max_servers and
> complimentary maxproc for the smtp-amavis transport). I
would try to
> get closer to 75% unused memory. I think this would
improve throughput.
> What is your $max_servers at now? How much memory does
a typical
> amavisd process use? If you were running at 50MB per
process, and you
> had 400MB to play with, I would increase the number by
4 or 5, wait a
> while (maybe an hour), and see where you are at again.

Sorry, I was trying to say 25% unused, 75% used.

Gary V


------------------------------------------------------------
-------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to
make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/
sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

On Tue, Aug 22, 2006 at 03:45:33PM -0400, Tom Gwilt wrote:
> On Tue, 22 Aug 2006, Gary V wrote:
> 
> > > FWIW, amavisd/spamassassin caught and either
blocked or flagged 125,667 
> > > SPAM messages in 13 hours.
> > 
> > I'm curious, is 250,000 (accepted) msgs/day
normal traffic for you or
> > are you getting hit with a substantial dictionary
attack like some
> > others? Do you reject mail to invalid recipients?
What is your system
> > load and available memory like? Are you swap
thrashing? Just wondering
> > if you need a bigger boat and/or you are wasting
what resources you
> > have on traffic you should be rejecting.
> > 
> > Gary V
> > 
> 
> Hi Gary,
> 
> We've had a pretty large amount of spam traffic for
the last couple of 
> years. Right now it's getting larger all the time.
Makes you wonder about 
> the viability of email down the road.
> 
> CPU loads run in the .85 to 1.40 (under heavy load),
swap isn't being 
> used, and there is always at least 50% available
memory.
> 
> I'm in a budget crunch and sort of have to make do.
We've thought about 
> filtering certain IP blocks at our edge router, but
that idea is not very 
> attractive to me. I'd rather find the real culprits,
tie them naked to the 
> back bumper of an air-conditioned car out in the middle
of the desert and 
> have someone drive about 5mph while I look at them out
of the back window 
> (drinking an ice-cold beer).


You really should use something like policyd-weight, and
greylisting (only
for "dialup" like addresses, I hate to delay
mail for normal servers). That
immediately reduces your load significantly..

Cheers,
Henrik

------------------------------------------------------------
-------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to
make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/
sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/