RE: Mailscanner Disk Layout - best practice for performance?
"Conz" <[email protected]> Sat, 13 Dec 2025 15:56:26 +0100
| Newsgroups | gmane.mail.virus.mailscanner |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. --===============7538578301400043463== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01DC6C49.0A173DE0" Content-Language: nl This is a multipart message in MIME format. ------=_NextPart_000_0001_01DC6C49.0A173DE0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, I have the following in my fstab: tmpfs /var/spool/MailScanner/incoming tmpfs rw,size=256M 0 0 I forgot if the installer put it there or if I put it there lol, this machine has been constantly updated since 2017. Few things to consider: Power loss/hard reset means anything in the queue is gone. Ram/tmpfs disk size determines maximum size of what can be in the queue. If you have a high volume where the queue often builds up you might have to scale to fit. Mine is very low volume and the 256MB is oversized. The whole server only has 6Gb of ram. I can't fully recall but a setup I used to manage from around 06 that did about 20-30k emails a day I think had a 512Mb ramdrive, its 10k disks and 4 core xeon could not keep up with the AV scanning back when multiple scanners still existed for Linux (I think I had 3). So, this'll depend a little on what sort of setup you have or are getting, like if its virtual or physical. Anything cloud, like your test setup, ramdrive absolutely because you'll probably get a fat bill otherwise. Anything virtual on premise and you'll want the ram drive or your hypervisor admin will get mad at you. Physical with spinning disks, also ram drive. Physical with nvme will be up for debate. There's the wear thing but it should be fine .. but considering the small amount of ram you need it'll depend on how bad a loss of email is to you. Any modern hardware with a physical install and it might also be an idea to just have a pair of small cheap nvme's in raid 1 if the idea of possibly losing emails is a problem for you. The cheaper the better so you can just have a spare on the shelf. Also, be sure to look at grey-listing if you get more than 2-3k e-mails a day, including spam. That'll have more positive impact on your server load than a ramdisk. The only downside is that there will be a few minutes delay for the first legit email from an unknown server and spam learning might be affected in a negative way if too much is blocked before getting scanned. I have had this problem. And don't forget to look at all the other stuff too like DKIM. Anything that can be kicked out BEFORE spamassassin or the AV has to do anything is 'resource profit' and more free cycles to deal with spam that got through :-) Iirc there is also some decent scaling information available on the mailscanner site or the book Julian wrote. You don't need a lot, but obviously It scales with volume. Hope this helps. Verzonden: vrijdag 12 december 2025 19:43 Aan: 'MailScanner Discussion' <mailscanner-qhrM8SXbD5JTOyd/[email protected]> Onderwerp: Mailscanner Disk Layout - best practice for performance? We're running a beta testing MailScanner with Mailwatch and postfix using Ubuntu 24 LTS on an AWS M6a.xlarge instance with 16G ram. Before going live, I want to split out the disks for best performance. Where do you see the highest disk utilization? With 16G ram I could squeak out a small ramdisk. Also have the option to go to provisioned IOPS although that gets expensive fast. Thanks for any suggestions! MailWatch Version: 1.2.23 Operating System Version: Ubuntu 24.04.3 LTS (Noble Numbat) Postfix Version: 3.8.6 MailScanner Version: 5.5.3 ClamAV Version: 1.4.3 SpamAssassin Version: 4.0.0 PHP Version: 8.3.6 MySQL Version: 10.11.13-MariaDB-0ubuntu0.24.04.1 GeoIP Database Version: No database downloaded ------=_NextPart_000_0001_01DC6C49.0A173DE0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 = (filtered medium)"><!--[if gte mso 9]><xml> <w:WordDocument> <w:DontUseAdvancedTypographyReadingMail/> <w:DontUseJustificationAdvancedTypographyReadingMail/> <w:DontUseHyphenationAdvancedTypographyReadingMail/> </w:WordDocument> </xml><![endif]--><style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Aptos;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; font-size:12.0pt; font-family:"Calibri",sans-serif; mso-ligatures:standardcontextual;} span.E-mailStijl19 {mso-style-type:personal-reply; font-family:"Aptos",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt; mso-ligatures:none;} @page WordSection1 {size:612.0pt 792.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.WordSection1 {page:WordSection1;} --></style></head><body lang=3DNL link=3D"#0563C1" vlink=3D"#954F72" = style=3D'word-wrap:break-word'><div class=3DWordSection1><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Hi,<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>I have the following in my fstab:<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>tmpfs /var/spool/MailScanner/incoming tmpfs = rw,size=3D256M 0 0<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>I forgot if the installer put it there or if I put it there = lol, this machine has been constantly updated since = 2017.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Few things to consider:<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Power loss/hard reset means anything in the queue is = gone.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Ram/tmpfs disk size determines maximum size of what can be = in the queue. If you have a high volume where the queue often builds up = you might have to scale to fit. Mine is very low volume and the 256MB is = oversized. The whole server only has 6Gb of ram. = <o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>I can’t fully recall but a setup I used to manage from = around 06 that did about 20-30k emails a day I think had a 512Mb = ramdrive, its 10k disks and 4 core xeon could not keep up with the AV = scanning back when multiple scanners still existed for Linux (I think I = had 3).<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>So, this’ll depend a little on what sort of setup you = have or are getting, like if its virtual or = physical.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Anything cloud, like your test setup, ramdrive absolutely = because you’ll probably get a fat bill = otherwise.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Anything virtual on premise and you’ll want the ram = drive or your hypervisor admin will get mad at = you.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Physical with spinning disks, also ram drive. = <o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Physical with nvme will be up for debate. There’s the = wear thing but it should be fine .. but considering the small amount of = ram you need it’ll depend on how bad a loss of email is to = you.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Any modern hardware with a physical install and it might = also be an idea to just have a pair of small cheap nvme’s in raid = 1 if the idea of possibly losing emails is a problem for you. The = cheaper the better so you can just have a spare on the = shelf.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Also, be sure to look at grey-listing if you get more than = 2-3k e-mails a day, including spam. <o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>That’ll have more positive impact on your server load = than a ramdisk. The only downside is that there will be a few minutes = delay for the first legit email from an unknown server and spam learning = might be affected in a negative way if too much is blocked before = getting scanned. I have had this problem.<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>And don’t forget to look at all the other stuff too = like DKIM. <o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Anything that can be kicked out BEFORE spamassassin or the = AV has to do anything is ‘resource profit’ and more free = cycles to deal with spam that got through :-)<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Iirc there is also some decent scaling information available = on the mailscanner site or the book Julian wrote. You don’t need a = lot, but obviously It scales with volume.<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'>Hope this helps.<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt;font-family:"Aptos",sans-serif;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><div><div = style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm = 0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US = style=3D'font-size:11.0pt;mso-ligatures:none'>Verzonden:</span></b><span = lang=3DEN-US style=3D'font-size:11.0pt;mso-ligatures:none'> vrijdag 12 = december 2025 19:43<br><b>Aan:</b> 'MailScanner Discussion' = <mailscanner-qhrM8SXbD5JTOyd/[email protected]><br><b>Onderwerp:</b> = Mailscanner Disk Layout - best practice for = performance?<o:p></o:p></span></p></div></div><p class=3DMsoNormal><span = lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US style=3D'font-size:11.0pt'>We’re running a beta = testing MailScanner with Mailwatch and postfix using Ubuntu 24 = LTS on an AWS M6a.xlarge instance with 16G ram. = <o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US style=3D'font-size:11.0pt'>Before = going live, I want to split out the disks for best = performance.<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US style=3D'font-size:11.0pt'>Where do you see the highest = disk utilization?<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US style=3D'font-size:11.0pt'>With 16G = ram I could squeak out a small ramdisk. Also have the option to go to = provisioned IOPS although that gets expensive fast. = <o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US style=3D'font-size:11.0pt'>Thanks = for any suggestions!<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'>MailWatch Version: = 1.2.23<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'>Operating System Version: Ubuntu 24.04.3 LTS = (Noble Numbat)<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US style=3D'font-size:11.0pt'>Postfix Version: = 3.8.6<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'>MailScanner Version: = 5.5.3<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'>ClamAV Version: 1.4.3<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'>SpamAssassin Version: = 4.0.0<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'>PHP Version: 8.3.6<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US style=3D'font-size:11.0pt'>MySQL = Version: 10.11.13-MariaDB-0ubuntu0.24.04.1<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US style=3D'font-size:11.0pt'>GeoIP = Database Version: No database downloaded<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US = style=3D'font-size:11.0pt'><o:p> </o:p></span></p></div></body></htm= l> ------=_NextPart_000_0001_01DC6C49.0A173DE0-- --===============7538578301400043463== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- MailScanner mailing list mailscanner-qhrM8SXbD5JTOyd/[email protected] http://lists.mailscanner.info/mailman/listinfo/mailscanner --===============7538578301400043463==--