Need help debugging a possible content filter problem

3 msg	Re: Virtual domain aliases
4 msg	address verify vs. virtual_alias_maps
20 msg	Postfix/ClamAV Config Error
4 msg	smtp /dev/poll problem
6 msg	Addresses filtering for only one supported domain
14 msg	Greylist question
1 msg	One transport with AUTH and other transport wit...
7 msg	Is this expected reject behavior for foreign IP...
3 msg	relay_domains and virtual_mailbox_domains not w...

Need help debugging a possible content filter p...
\ Rob Tanner (28 Nov 2007)
. \ Victor Duchovni (28 Nov 2007)

11 msg	spam emails with \| in front of the email addresses
9 msg	unexpected domain rewrite (by postfix?)
5 msg	Error receiving email
20 msg	Postfix 2.5-20071111, smtp.gmail.com, bouncing ...
1 msg	Bounce notification configure
45 msg	Re: Recipient validation
2 msg	Use of MySQL for lookups
8 msg	proposal: change behavior with respect to recip...
11 msg	OT: Any bad DKIM experiences?
8 msg	hashed spool directories

Subject:	Need help debugging a possible content filter problem
Group:	Postfix-users
From:	Rob Tanner
Date:	28 Nov 2007

Hi,

We use a commercial anti-virus/spam filter configured as a content
filter. Everything runs smooth and even though we are processing some
30 or 40 thousand emails, the CPU load is typically down in the level of
the noise (i.e., hardly enough to measure). Now suddenly I'm seeing
periods where the process load jumps way up, the five minute average
sometimes hitting the mid 40's. When this happens, the Postfix mailq
can sometimes get several thousand deep.

I think the problem is the content filter, mainly because I can stop
Postfix and the load only very slowly drops. There are no specific
errors (at least none that generate log entries). The one thing I do
notice is in the maillog entries when Postfix relays the mail to the
filter. This is an example:

relay=localhost.linfield.edu[127.0.0.1], delay=1780, status=sent (250
OK, sent 474CE652_12080_9_2 )

My question is what exactly is the delay value? What is it measuring?
When everything is running nicely, the delay value seldom even gets as
high as 10 but in the above example, it's 1780. Wjat exactly is it?

Thanks,

--
Rob Tanner
UNIX Services Manager
Linfield College, McMinnville OR