[afnog] Spamassassin warning (was: Spamassassin help)

[David Peall]

> Hi guys,
> 
> Just so you know, spamassassin has a nasty failure mode that
> you should be aware of:
> 1. Spamassassin is reasonable CPU-intensive and hence makes a higher
>    load on your mailserver
> 2. If the load peaks (for instance, because of a mail peak), the load
>    may rise high enough so that the MTA temporary doesn't accept mail
>    till the load drops a bit.
>    It takes a while for the peak to get through the filter system,
>    so the load stays a while
> 3. During this time, at various places in the world mail gets queued
>    waiting for your MTA to accept mail again
> 4. Once the load lowers and the MTA accepts mail, the additional mail
>    queued will raise the load again, which again causes the 
> MTA to block.
>    All the mailservers together trample the mailserver as soon as it
>    accepts mail again, till it stops accepting mail.
> 5. Point 3-4 happen over and over, oscillating between accepting
>    and not-accepting mail
> 
> The places where I've seen this, the ISP had no choice but to 
> disable spamassassin for a while just to lower the floodgates.
> 
> To me, this effect came as a surprize the first time I saw it,
> and I think you may want to be aware of it and at least monitor
> the load on your boxes.

Make sure you are not passing any mail larger then 80k through
SpamAssassin as recommended on their website as this will drive the CPU
usage through the roof.  Also Spam seldom tends to be bigger then 80k. 

Regards,

David Peall :: Systems Administrator
e-Schools' Network :: http://www.esn.org.za/ 
Phone +27 (021) 674-9140