First of all, MailScanner and the other applications it runs do use
server resources. If you are seeing occasional high CPU usage, this is
usually quite normal as a MailScanner process will basically use as much
resources as are available. If the high resource usage is not actually
causing any performance problem for end-users, then it is probably
nothing to worry about. The information in WHM > CPU/Memory/MySQL
Usage does not really give an accurate picture of the server resource
usage over time as it basically shows the peaks and not an overall view.
The best way to get an idea is to check it in "top" and watch it for a
while to see if there really is a problem with MailScanner using server
resources.
You should first
make sure you are running the latest versions
of MailScanner, ClamAV and the MailScanner Front-end. This is all found
in WHM > ConfigServer MailScanner FE near the bottom of the page.
You should also
make sure that there are no actual problems with MailScanner
by tailing /var/log/maillog to check for any errors, looping, etc.
Certain types of problems can sometimes lead to MailScanner causing high
server loads.
tail -f /var/log/maillog
Also
check to see how many mails are currently waiting to be processed by MailScanner, with:
exim -bpc
Note: If you are running MSFE v3.6 or higher you can tail the maillog and view the queues in the WHM MailScanner front-end.
Make sure you are using clamd and not clamav in WHM >
ConfigServer MailScanner FE > MailScanner Configuration > Virus
Scanners. Running clamav without the clamd daemon tends to use excessive
server resources.
If the MailScanner processing
is actually causing performance
problems for end users, there are several things that you can try to
reduce MailScanner's use of resources. The first thing to think about,
if MailScanner is otherwise running smoothly, is whether adding more RAM
to the server is an option, as this will often help. If you can't do
that, or if adding RAM does not help, try one or more of the following
in turn. After making each change, wait a while to see if it makes a
difference in server performance.
1.
Reduce the number of MailScanner child processes. Set WHM
> MailScanner > MailScanner Configuration > Max Children to 2
if it is set to 3 - or to fewer than whatever you currently have it set
to. The more child processes you have, the more memory will be used. The
advice in the config file to try 5 per CPU is not really relevant for a
cPanel server that is running web and other services as well.
You should only reduce the number of children if email throughput is
not high. In other words, if there is so much mail traffic through your
server that all of your MailScanner processes are constantly busy trying
to keep up with the mail, then reducing the number of children isn't a
good idea.
Note: If you have MSFE v3.8 or higher, you can do this in the WHM MailScanner front-end under MailScanner Performance.
2.
Move RBL checking from MailScanner to exim. This will block
any RBL-listed IP addresses immediately in exim rather than sending
them to MailScanner for processing, which may help reduce resource
usage
3.
Disable File Attachment checking. Follow the instructions in this FAQ to disable checking of attachments except for virus scanning
Note: If you have MSFE v3.8 or higher, you can do this in the WHM MailScanner front-end under MailScanner Performance.
4.
Disable Dangerous Content scanning. Go to WHM >
MailScanner > MailScanner Configuration > Dangerous Content
Scanning = and set this to "no". This will disable checks on the actual
content of messages, for example for dangerous HTML tags or possible
phishing fraud, as well as disable checking of file attachments (except
for virus scanning).
Note: If you have MSFE v3.8 or higher, you can do this in the WHM MailScanner front-end under MailScanner Performance.
5.
Disable MailWatch. Go to WHM > ConfigServer MailScanner FE > MailScanner Performance and click "Disable MailWatch".
6.
Remove the SpamAssassin SARE rules. (Note: We no longer
recommend using the SARE rules at all; they are no longer being updated
and most of the good rules have been incorporated into SpamAssassin.)
Everytime MailScanner runs it loads up SpamAssassin with all of the
rules in memory so the more rules there are, the more memory will be
required.
The SARE rules may be located in one or more of the following directories depending on when you had MailScanner installed:
/etc/mail/spamassassin/
/etc/mail/spamassassin/RulesDuJour
/var/lib/spamassassin/3.00x00x/ (the number refers to your version of
SpamAssassin, i.e. if you're running SA 3.3.1 the directory being used
is 3.003001)
The SARE rules all have "sare" as part of the directory and/or file
name, and any such directory/file within the above directories can be
removed.
You should also remove any rules_du_jour script from your /root/
directory and remove the cron job that runs it. If you have sa_rules.sh
instead in your /root/ directory, edit it and remove any line referring
to sare.
7. At the end of the day if your server cannot cope with the load
that MailScanner processing puts on it, given your server resources and
the amount of email traffic on the server, you may need to uninstall
MailScanner.
