spamassassin uses too much memory

[thisisit3]

Spamassassin uses too much memory and the default is to run 5 processes. That means spamd can eat your available memory pretty quickly.

Here is a solution:

If you use cPanel/WHM then edit the /etc/init.d/exim, look for max-children and set that to 2 or 3.

--max-children=${maxchildren=5} \

An alternative method is to install "spamdconf" cPanel module (under WHM -> cPanel -> Addon Modules).

[thisisit3]

So, your spamd is using too much memory and too much CPU? There are two things you can do about that. First, lower the max children from 5 to 3 and second, switch from using TCP to UNIX sockets.

The first is easy to do, just follow the post above. I believe its best to install the cPanel Addon module "spamdconf" which takes care of everything (it generates the config file /etc/cpspamd.conf).

The second needs a lot more and has one drawback, once a new exim/spamassassin update is released then your changes will be lost, thus you may need to create some diff patches.

Here we go:

** STEP 1 - configuration file - /etc/cpspamd.conf **

vi /etc/cpspamd.conf

We need to replace this line:
allowedips=127.0.0.1
to this one:
socketpath=/var/run/spamd.sock

It is important for not to have allowedips line anymore as it is not compatible with socketpath for common-sense reasons.

If you have no /etc/cpspamd.conf you better to login to root WHM and install "spamdconf" Module via Addon Modules. Of course, you may just have the /etc/cpspamd.conf with single socketpath line

** STEP 2 - init file - /etc/init.d/exim **

vi /etc/init.d/exim

Edit the lines right after words echo -n "Starting spamd: " for them to look like this:

$DAEMONIZE /usr/bin/spamd -d ${local+"--local"} --socketpath=/var/run/spamd.sock \
${timeouttcp+"--timeout-tcp="}${timeouttcp} ${timeoutchild+"--timeout-child="}${timeoutchild} \
--pidfile=${pidfile-"/var/run/spamd.pid"} --max-children=${maxchildren=5} \
${maxconnperchild+"--max-conn-per-child="}${maxconnperchild}

E.g. we have replaced the --allowedips with --socketpath. This allows us to restart Exim via "service exim restart" and have proper settings.

** STEP 3 - cPanel Restart module - /scripts/RestartSrv.pm **

There are several changes we need to perform.

vi /scripts/RestartSrv.pm

After this line:
my $allowedips = '--allowed-ips=127.0.0.1';
enter the new one:
my $socketpath = '--socketpath=/var/run/spamd.sock';

Then after these lines:
if ($option eq 'allowedips')
$allowedips = "--allowed-ips=${value}";
}
enter new ones:
elsif ($option eq 'socketpath') {
$socketpath = "--socketpath=${value}";
}

Then several lines below, at the line $spamdoptions = ...
REPLACE $alloweips to $socketpath

The last change in this file is to find function sub spamdcheck and update the launch line for spamc.
Replace this line:
open2(\*RDRFH, \*WTRFH, '/usr/bin/spamc');
to another one:
open2(\*RDRFH, \*WTRFH, '/usr/bin/spamc -U /var/run/spamd.sock');

** STEP 4 - exim.conf changes **

There are two things to be done. First one is to login to WHM -> Exim Configuration Editor and then click to the Advanced Mode.

At the first box at the very top (even before av_scanner = clamd:/var/clamd should you have it) type this line:
spamd_address = /var/run/spamd.sock

Click to save at the bottom of the page and you almost done.

The last thing to replace path to spamc at the transport sections. Beware that we do it on the /etc/exim.conf directly and should you rebuild it by either changing anything via Exim Configuration Editor or add/remove clamav, etc. you will miss these changes!

vi /etc/exim.conf

Replace this line (there are TWO lines you need to replace!):
transport_filter = "/usr/bin/spamc"
to this one:
transport_filter = "/usr/bin/spamc -U /var/run/spamd.sock"

** STEP 5 - restart, testing changes **

Now we ready to execute /scripts/restartsrv_exim to restart Exim and make sure we have spamd via sockets by executing /scripts/restartsrv_spamd --status (should be able to see socketpath=/var/run/spamd.sock) and /scripts/restartsrv_spamd --check - there should be no warnings.

Watch these files to make sure you receive no errors on spamd/spamc:
tail -f /var/log/exim_mainlog
tail -f /var/log/maillog

[LordZ]

Hmm, good tutorial. But

vi /scripts/RestartSrv.pm

After this line:
my $allowedips = '--allowed-ips=127.0.0.1';

can't find this line dude, /scripts/RestartSrv.pm - is /scripts/restartsrv_spamd or /scripts/restartsrv_exim?

also I don't see this lines

Then several lines below, at the line $spamdoptions = ...
REPLACE $alloweips to $socketpath

The last change in this file is to find function sub spamdcheck and update the launch line for spamc.
Replace this line:
open2(\*RDRFH, \*WTRFH, '/usr/bin/spamc');
to another one:
open2(\*RDRFH, \*WTRFH, '/usr/bin/spamc -U /var/run/spamd.sock');

in no one of the mentioned scripts.
What is your CPanel version???

[Matt Smith]

Any downsides to decreasing the maxchildren?

[LordZ]

well, I noticed load is much little and still no complains from clients