Hello Everyone,
I currently have the current setup:

Fedora Core 5
MailScanner
Spamassassin
ClamAV

All Messages are forwarded to my internal exchange server. I noticed that all messages are taking at least 250 seconds or more to process:

Jun 24 09:57:20 localhost MailScanner[9392]: Batch (1 message) processed in 277.04 seconds
Jun 24 09:57:36 localhost MailScanner[9155]: Batch (1 message) processed in 273.49 seconds
Jun 24 09:57:46 localhost MailScanner[9160]: Batch (1 message) processed in 269.35 seconds

This all started after a couple of weeks when I created a cron job to learn spam every 8 hours:

user --showdots --mbox --spam /var/mail/usermailbox

I since then disabled the cron job and now I want to lower the process time. Your help is appreciated.

Your SA database is OK? Tried (backing up and) rebuilding the database? Anything got upgraded in the mean time? Any (seemingly unrelated) errors in application or system logs?

Found the culprit. It was the ClamAV slowing down the flow of email. It was spiking my cpu 100%. THis system has not been touched for about a month. I wonder why that would start? Any ideas?

I don't know for sure if it's a recent change or not because I didn't check before but I recently ran some AV scans (scanning malware while working on Rootkit Hunter's 'suspscan') and I found ClamAV was busy for ages unpacking its own signature databases before it started to scan. Maybe not the same as with the daemonized scanner, but if the process doesn't keep its db's open in memory (what one could maybe expect) then this will kill performance each time it starts up.

I had exactly the same problem on my corporate mail gateways I look after, these boxes run RHEL4 & Postfix/MailScanner/ClamAV. Each time I had even a small sized message come in, the CPU usage shot up to 95% plus, (on a 2.8GHz Xeon), the culprit was clamav.

It would seem that there is a large CPU overhead in calling ClamAV to scan individual messages, the solution is to use ClamAV in daemon (clamd) mode.

To do this, you will need to upgrade to MailScanner 4.61 as this supports clamd as a virus scanning option, then reconfigure ClamAV to run in daemon mode, and reconfigure MailScanner to use clamd instead of clamav, make sure clamd is started and that should be it.

As far as I can remember, the MailScanner.conf file has some self explanatory information on configuring MailScanner to use clamd instead of clamav. The clamav website should be able to help with the clamd side of things.

Hope this is of some help to you and it helps you fix the problem. It dramatically reduced the overhead on my mail gateways and mail is flowing much quicker now.