[sclug] spamassassin taking too long

[darren at davisononline.org]

hi,

I run a small home server - low spec, but low load too.  It runs a mail
server for me, and via procmail all messages below .25Mb get screened by
spamassassin.  This is set to run in spamd/spamc mode.

Recently, spam started to get through unchecked (no spam headers added) and
investigation showed what I think was choked up spamc processes or timing
out processes, not sure which.  Restarting the spamd daemon cures it for a
while.

The logs show most messages now taking over 100s to be scanned, but this is
not universal - a couple in the list below took less than a second:

bacall ~ # grep spamd.*seconds /var/log/mail.log | tail
Feb 22 06:45:08 bacall spamd[23623]: spamd: clean message (-2.8/5.0) for
darren:1000 in 0.9 seconds, 917 bytes.
Feb 22 07:03:21 bacall spamd[23623]: spamd: clean message (-8.4/5.0) for
darren:1000 in 102.7 seconds, 3870 bytes.
Feb 22 07:12:05 bacall spamd[23623]: spamd: clean message (-2.8/5.0) for
darren:1000 in 100.3 seconds, 894 bytes.
Feb 22 07:15:26 bacall spamd[23623]: spamd: clean message (0.7/5.0) for
lisa:1001 in 1.8 seconds, 14429 bytes.
Feb 22 07:39:19 bacall spamd[23623]: spamd: clean message (-1.4/5.0) for
darren:1000 in 102.5 seconds, 27197 bytes.
Feb 22 08:03:08 bacall spamd[23623]: spamd: clean message (-2.3/5.0) for
darren:1000 in 102.4 seconds, 5729 bytes.
Feb 22 08:10:51 bacall spamd[23623]: spamd: clean message (-8.4/5.0) for
darren:1000 in 101.9 seconds, 3622 bytes.
Feb 22 08:16:57 bacall spamd[23623]: spamd: clean message (-2.5/5.0) for
darren:1000 in 101.9 seconds, 5909 bytes.
Feb 22 08:27:09 bacall spamd[23623]: spamd: identified spam (15.8/5.0) for
darren:1000 in 100.8 seconds, 3747 bytes.
Feb 22 08:34:08 bacall spamd[23623]: spamd: clean message (-8.8/5.0) for
darren:1000 in 102.0 seconds, 6129 bytes.

A quick google suggested this may be to do with bayes token expiry happening
on each message, but that's unclear to me.  Performing a "sa-learn
--force-expiry" takes about 100s which kind of supports that.

Is this just something I have to accept with sa or can I do something about
it?  If it's going to cause the server to choke on the small volume of mail
I receive and therefore let spam in anyway, it kind of defeats the purpose
of using it.  How do other sa users find this?

Cheers!

-- 
Darren Davison
Public Key: 0xDD356B0D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 191 bytes
Desc: not available
Url : http://lists.tmdg.co.uk/pipermail/sclug/attachments/20060222/410a1a3d/attachment.bin