Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
1058 Views 2 Replies Latest reply: Nov 6, 2012 12:11 AM by ijahnke RSS
dbetanco Newcomer 1 posts since
Oct 12, 2012
Currently Being Moderated

Oct 12, 2012 9:42 AM

Ironmail Performance - S120 Appliance

We're starting to experience processing performance issues on our Ironmail S120 appliance and seeing at our high end around 15,000 - 20,000 messages and connections per hour. I was curious if any other Ironmail owners/admins could comment on your performance based on these numbers. When we first purchased the appliance it was rated at processing 45,000 messages per hour, so we're a bit suprised at the recent performance issues.

 

Thanks for any feedback,

Dan

 

 

[McAfee]: show stats mph 20121011

20121011::01:00:00    3392

20121011::02:00:00    1489

20121011::03:00:00    1892

20121011::03:59:59    1786

20121011::04:59:59    2046

20121011::06:00:00    3290

20121011::06:59:59    6609

20121011::08:00:00    10195

20121011::09:00:00    10914

20121011::10:00:00    13523

20121011::10:59:59    17664

20121011::11:59:59    16351

20121011::13:00:00    14899

20121011::13:59:59    9200

20121011::15:00:00    9406

20121011::16:00:00    9645

20121011::17:00:00    7629

20121011::18:00:00    4611

20121011::18:59:59    4859

20121011::19:59:59    3557

20121011::21:00:00    3390

20121011::21:59:59    2679

20121011::22:59:59    2595

20121012::00:00:00    2224

 

[McAfee]: show stats cph 20121011

20121011::01:00:00    6755

20121011::02:00:00    2429

20121011::03:00:00    2778

20121011::03:59:59    2637

20121011::04:59:59    2915

20121011::06:00:00    3879

20121011::06:59:59    12143

20121011::08:00:00    16617

20121011::09:00:00    10054

20121011::10:00:00    19368

20121011::10:59:59    27352

20121011::11:59:59    23552

20121011::13:00:00    22879

20121011::13:59:59    10002

20121011::15:00:00    12586

20121011::16:00:00    12386

20121011::17:00:00    11293

20121011::18:00:00    8463

20121011::18:59:59    7393

20121011::19:59:59    6963

20121011::21:00:00    6271

20121011::21:59:59    5092

20121011::22:59:59    4628

20121012::00:00:00    3691

  • klaatu Newcomer 7 posts since
    Nov 2, 2012
    Currently Being Moderated
    1. Nov 5, 2012 5:05 PM (in response to dbetanco)
    Re: Ironmail Performance - S120 Appliance

    Not sure if this is correct, but I've been seeing the same degredation in performance and I wonder if it's related to just general increases in the complexity of the spam filters. One would imagine that over time, the filters have to be more sophisticated to deal with the ever increasing diversity of spam... For me, it's an indicator that it might be time to look at a SaaS option, if only $boss would allow it.

  • ijahnke McAfee Employee 122 posts since
    May 12, 2010
    Currently Being Moderated
    2. Nov 6, 2012 12:13 AM (in response to klaatu)
    Re: Ironmail Performance - S120 Appliance

    You are correct, over time the spam filters do become more complex. However, just for clarification, mph is messages per hour that were accepted.  For better or for worse, these are messages that were accepted by smtpproxy and were processed by superq.  cph is connections per hour and can be rather misleading. It covers everything else and has been the bane of support to explain how the reports get their numbers. The bottom line is that, unless you have an external device checking smtp connectivity, all smtp connections should contain at least one message. The top reasons why a message is not accepted by the smtpproxy are IP reputation, Message reputation, and LDAP. TrustedSource IP and message reputation both require that the message be fully recieved, while ldap can refuse during the smpt conversation but it cant drop the connection until the sending server is done or if it had to many failures.

     

    Putting a rate on mailflow only looks good on paper, it rarely applies to the real world. In this case we can see a max cph of 27352. One thing to keep in mind is that when appliances are being rated they are typically only being rated on "Normal email", which usually falls in the range of 1 - 20kb in size, give or take.  In the real world, people love to send prettified word documents, over edited xlxs, picturesque power points, and jpegs of, well, anything - these take a toll on mail systems because they are usually in the range of 1 - 10MB and often occur during peek hours. Combine this with poor network issues (client side) and volume spikes then you can start to see how 27352 can begin taxing a system. As a side note there is grey area here, this is all assuming that each connection holds only one message, however they can hold many, many, many more (I once saw a connection that contained several hundred thousand.). This is why it can be difficult to explain the numbers in the reports.

     

    I can say that the ironmail can handle an incredible amount of "Normal mail" in a lab setting. In my lab I have an EG5500 and using a linux smtp tester (xstress, its wonderfull!!) I maxed out at 600k mph, and that was because my smtpo was backing up - the mail servers couldnt handle the load (exchange on a dell r710 and 2950).

     

    Also, you may want to speak to your Sales Rep about SaaS, it might already be included depending on what you purchased.

     

    on 11/6/12 12:13:54 AM CST

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points