email forwarding locally consumes all resources

[rdells]

Thanks again for your all your advise, really appreciate it.
I did not do the previous post - I like install and leave alone (nervous)!!
I did read about spamassissin and realize now that my machine probably is not powerful enough to have spamassassin on more than a few accounts!
The FAQ on spamassasin told me the story:
http://wiki.apache.org/spamassassin/...AskedQuestions
Again, Thanks
Robert

[till]

How many email accounts do you have and what processor and how much ram does your server has?

Which of the FAQ articles do you refer to?

[rdells]

Hi there,

I suppose I could do some tweaking, I just moved onto other things for now.
One FAQ: http://wiki.apache.org/spamassassin/FasterPerformance
talked about fine tuning. Looks useful, just have not tried yet.

I added ram: was 256 (when had issues), now 512 (still hungry).
Cpu is Duron 800Mhz, Shuttle AK10 mobo.
30 email accounts. was AV + Spamfilter (when had issues), now only AV (seems good).

2 WD IDE 80GB hard drives (raid1, hda, hdc) not using "Quota" (could not figure out how to do Quota with raid1 w/in fstab file).

Note: I did the same setup on a P3 833Mhz, 512Mb ram, near-same all other hardware. I got the near-same results from Spamassassin enabled on the email accounts (near 100% cpu jump while sending to the email acct w/spamassassin enabled, minimal cpu% with only AV enabled).

I may try tweaking Spamassasin in a few days, I'll be sure to let you folks know of outcome if you like, Maybe I should have tried Debian for the older hardware?? !!

(I liked the Fedora Raid setup, was easier than debian ).

Thanks always,
Robert

[falko]

Originally Posted by rdells

I may try tweaking Spamassasin in a few days, I'll be sure to let you folks know of outcome if you like

That would be great!

[MathieuMa]

Hi,

I have a mail address setup to forward to 4 other mail addresses (as account-less mail list are not possible yet).

When receiving a mail to that list, even though the antivirus is setup on it, it forwards the mail to the 4 other accounts, and because of this the mail is scanned 4 times - and passes through spamassassin 4 times as well.

Could it be possible to have the forwards done AFTER the scans ?
And then use added headers to not run those twice (that's just an idea - not sure what it's worth regarding security, IE if the sender set that particular header we should remove it first) ?

The issue here is that this takes a lot of CPU (4 scans) , and when a virus is found a mail is sent 4 times (once per account) to the mail list saying a virus was found (disabled that for now).


Thanks, Mathieu

[falko]

Originally Posted by MathieuMa

I have a mail address setup to forward to 4 other mail addresses (as account-less mail list are not possible yet).

When receiving a mail to that list, even though the antivirus is setup on it, it forwards the mail to the 4 other accounts, and because of this the mail is scanned 4 times - and passes through spamassassin 4 times as well.

Are those 4 email addresses on the same server, and is SpamAssassin enabled for these 4 addresses?

[MathieuMa]

Originally Posted by falko

Are those 4 email addresses on the same server, and is SpamAssassin enabled for these 4 addresses?

The 4 addresses are on the same server, and SA / Antivirus is enabled on those 4.

Performance wise, what I'd like to have would be the following :
- SA scan on the alias done -> no more SA scan on the ML mails
- Antivirus scan on the alias done -> no more AV scan on the ML mails

Or at least have virus mail not forwarded, they should go to /dev/null as soon as they hit the alias, but are forwarded before apparently.

Oh, the forwards are done to user_name@domain.com, not user_name - but that should be correct ?

[falko]

We can think about how we can accomplish this, but right now it's not possible with ISPConfig.

Oh, the forwards are done to user_name@domain.com, not user_name - but that should be correct ?

Yes, that's ok.

[MathieuMa]

Originally Posted by falko

We can think about how we can accomplish this, but right now it's not possible with ISPConfig.

OK, will wait for next version or better try go get an idea
The issue with internal ML as of now is that they consume a lot of resources due to antivirus and antispam - I thought it could be just a processing order question for a part of the issue (antivirus before forward -> if the message is discarder it's only scanned once).

[chrno]

Hi falko,

I'm seeing the same thing when I've SpamAssassin and ClamAV selected.

I've got an email address that sends the same email (hourly reports) to about 4 email address (managers's address) on the same domain. Not via forwarding in ISPconfig, just notmal To: and Cc: via smtp. And of course these emails will be received at the same time by the mail server. This's when I see a spike in the CPU (going as high as 100% usage). Top at that time shows that ClamAV and SpamAssassin is using +-25% for each of the 4 email users (web3_username)... which prompted me to ask about the performance impact on the server when SpamAssassin/Mailscan/ClamAV is activated (This Thread). For now, I've deactivated SpamAssassin and ClamAV on all these 4 accounts because I thought it's because I'm using a develepment copy (ISPConfig-2.3.0-dev.tar.gz) until I saw this thread ...

Should I try to compile my own SpamAssassin? If I compile it, will I have upgrade issues with the next release/version of ISPConfig?

Additional Info:-

/home/admispconfig/ispconfig/tools/spamassassin/usr/bin/spamassassin -V
SpamAssassin version 3.1.0
running on Perl version 5.8.8

Machine spec
AMD Duron 1GHz with 256MB ram 
swap 700MB

OS
Debian Sarge