ConfigServer Services
Server Management Services from Way to The Web Ltd

MailScanner is using a lot of server resources, is there anything I can do?

First of all, MailScanner and the other applications it runs do use server resources. If you are seeing occasional high CPU usage, this is usually quite normal as a MailScanner process will basically use as much resources as are available. If the high resource usage is not actually causing any performance problem for end-users, then it is probably nothing to worry about. The information in WHM > CPU/Memory/MySQL Usage does not really give an accurate picture of the server resource usage over time as it basically shows the peaks and not an overall view. The best way to get an idea is to check it in "top" and watch it for a while to see if there really is a problem with MailScanner using server resources.

You should first make sure you are running the latest versions of MailScanner, ClamAV and the MailScanner Front-end. This is all found in WHM > ConfigServer MailScanner FE near the bottom of the page.

You should also make sure that there are no actual problems with MailScanner by tailing /var/log/maillog to check for any errors, looping, etc. Certain types of problems can sometimes lead to MailScanner causing high server loads.

tail -f /var/log/maillog
Also check to see how many mails are currently waiting to be processed by MailScanner, with:

exim -bpc
Note: If you are running MSFE v3.6 or higher you can tail the maillog and view the queues in the WHM MailScanner front-end.

Make sure you are using clamd and not clamav in WHM > ConfigServer MailScanner FE > MailScanner Configuration > Virus Scanners. Running clamav without the clamd daemon tends to use excessive server resources.

If the MailScanner processing is actually causing performance problems for end users, there are several things that you can try to reduce MailScanner's use of resources. The first thing to think about, if MailScanner is otherwise running smoothly, is whether adding more RAM to the server is an option, as this will often help. If you can't do that, or if adding RAM does not help, try one or more of the following in turn. After making each change, wait a while to see if it makes a difference in server performance.

1. Reduce the number of MailScanner child processes. Set WHM > MailScanner > MailScanner Configuration > Max Children to 2 if it is set to 3 - or to fewer than whatever you currently have it set to. The more child processes you have, the more memory will be used. The advice in the config file to try 5 per CPU is not really relevant for a cPanel server that is running web and other services as well.

You should only reduce the number of children if email throughput is not high. In other words, if there is so much mail traffic through your server that all of your MailScanner processes are constantly busy trying to keep up with the mail, then reducing the number of children isn't a good idea.

Note: If you have MSFE v3.8 or higher, you can do this in the WHM MailScanner front-end under MailScanner Performance.

2. Move RBL checking from MailScanner to exim. This will block any RBL-listed IP addresses immediately in exim rather than sending them to MailScanner for processing, which may help reduce resource usage

3. Disable File Attachment checking. Follow the instructions in this FAQ to disable checking of attachments except for virus scanning

Note: If you have MSFE v3.8 or higher, you can do this in the WHM MailScanner front-end under MailScanner Performance.

4. Disable Dangerous Content scanning. Go to WHM > MailScanner > MailScanner Configuration > Dangerous Content Scanning = and set this to "no". This will disable checks on the actual content of messages, for example for dangerous HTML tags or possible phishing fraud, as well as disable checking of file attachments (except for virus scanning).

Note: If you have MSFE v3.8 or higher, you can do this in the WHM MailScanner front-end under MailScanner Performance.

5. Disable MailWatch. Go to WHM > ConfigServer MailScanner FE > MailScanner Performance and click "Disable MailWatch".

6. Remove the SpamAssassin SARE rules. (Note: We no longer recommend using the SARE rules at all; they are no longer being updated and most of the good rules have been incorporated into SpamAssassin.) Everytime MailScanner runs it loads up SpamAssassin with all of the rules in memory so the more rules there are, the more memory will be required.

The SARE rules may be located in one or more of the following directories depending on when you had MailScanner installed:

/var/lib/spamassassin/3.00x00x/ (the number refers to your version of SpamAssassin, i.e. if you're running SA 3.3.1 the directory being used is 3.003001)

The SARE rules all have "sare" as part of the directory and/or file name, and any such directory/file within the above directories can be removed.

You should also remove any rules_du_jour script from your /root/ directory and remove the cron job that runs it. If you have instead in your /root/ directory, edit it and remove any line referring to sare.

7. At the end of the day if your server cannot cope with the load that MailScanner processing puts on it, given your server resources and the amount of email traffic on the server, you may need to uninstall MailScanner.

Self-Hosted Help Desk Software by SupportPal.


Forgot password?
Register now