[Avcheck] I guess we need faster disk channel, huh?

[Michael Tokarev]

Len Conrad wrote:
> 
> >And another note.  For a *dedicated* virusscanning machine, it may be useful
> >to forward mail to a sending machine right from avcheck.
> 
> this is already done with relayhost, with the vast majority of smtp/relay
> lines being "delay=0", sometimes 1 or 2, although I do see periods where
> the delay can shoot up to 60 for a cluster of msgs.

You can place your relayhost into the avcheck command line.  This should
almost double disk speed (avcheck itself not uses any fsync()s etc, it
is postfix who stress disks).  With your current scheme, every message
passes postfix queue twice on the same machine.  I don't know if this
will help with overall performance -- worth a try.  Note that in the
case when avcheck will forward messages to another machine, delay=xx
line will show complete time a message was on your virusscanner host.
For a "cluster of msgs", where 2nd delays are significant, changing
avcheck's reinjection path should help significantly.  Note also
that by omitting one step you'll reduce one Received: line and several
syslog lines as well.

In short.  In your situation, if you think it is disk i/o issue,
changing avcheck's reinjection path to use relayhost directly will
either improve performance (almost 2 times) OR prove that this isn't
a disk problem but CPU problem -- both are good results.

> 22 minutes is delay=1300, but that was just one episode

It should be CPU not disk -- a virusscanning speed.  Or a deferral
(for this last one you can't do much; btw, try grepping for "deferred").

Regards,
 Michael.