Lots of SA timeouts lately - ClamAV?

[kemis]

Starting about 4 days ago (July 14, 2008), I've been getting a couple hundred e-mails a day that are making it through the spam checking process because SA times out.

My users are starting to complain.

So... thinking about it, I believe this is around the time I upgraded to the most recent ClamAV. Could this be the culprit? Is there a way to downgrade, or maybe I should to something else first/instead?

Currently, my settings are as follows:

Restart Every = 14400
Max Children = 3
SpamAssassin Timeout = 75
Max SpamAssassin Timeouts = 10
SpamAssassin Timeouts History = 20
Virus Scanners = clamd
Virus Scanner Timeout = 300

Thanks!
Matt

[kemis]

Okay, I just realized from my MailWatch report that the "timeout spams" are roughly 6 minutes apart each!

360 seconds is awfully close to the 300 second setting for clamav timeout...

Just a thought,
Matt

[Sarah]

Nope. If the email says SA timeout, then it's SA and nothing to do with ClamAV. Usually this is due to network or DNS issues on your server.

[kemis]

Well, I guess I should clarify something. The "spam report" simply says "timed out". It doesn't specifically mention it was an SA timeout. How do I tell if it was specifically an SA timeout, or a clamav timeout? Which log file would that be in?

Another oddity I just realized is that my bayes scores are not being applied! What causes bayesian rules to suddenly stop? I'm not sure when that started yet...

Matt

[Sarah]

If the spam report says "timed out" that means spamassassin timed out. You will probably see mentions of this in the maillog if you look. Now that you mention bayes that can also cause timeouts. Check your maillog for clues. Also try running SA directly on an email (spam would be best) by copying the full raw text of the entire email including headers into a text file, say "spam.txt" and then run this command:

spamassassin -t -D < spam.txt

Watch where it hangs, and that will help you determine where the problem is.

Regards,
Sarah