C300 box sizing -performance

yanir_ironport · ‎07-02-2007

Hi

Is there anyone who can advice regarding ,how many msg/min /hour -i can reach with this machine without getting a long delays .

I need to know few parameters since i want to tell applications that send mail through the box how to behave .

Thanks

jbivens_ironport · ‎07-03-2007

Yanir,

So first things first, what features do you have enabled? (Brightmail, IronPort AntiSpam, Sophos, VOF, etc. etc.)

Any idea of what your average message size is? (You can get this information with utilities like spamtowho)

Sincerely,

Jay Bivens
IronPort Systems

yanir_ironport · ‎07-03-2007

Hi

I have ipas anti spam enabled _sophos anti virus enabled

my avarage msg per hour is around 5000msg

how can i know my -is there any statistics form the box itself ?

Yanir

Doc_ironport · ‎07-05-2007


how can i know my -is there any statistics form the box itself ? 
Yanir

You can get CPU, memory and disk stats from the box by going to Monitor -> System Status in the web GUI or by running "status detail" from the CLI.

These same numbers are also available via the SNMP, or XML (http://boxname.domain.com/xml/status )

Scott.

jbivens_ironport · ‎07-05-2007

Yanir,

Keep in mind that they below comments are related to messages through the e-mail pipeline. The below performance data is only measuring the messages that make it through Senderbase, so if you get 5K message per hour but 3K are blocked by Senderbase then you would only be talking about 2K messages through the pipeline.

So in general when IronPort performs performance testing we do it with varying message sizes but the average always comes out to 15 KB. So my rule of thumb (and your mileage my vary) is that a C300 can handle ~500K messages a day (which covers peak message volume hours) and this number is really for inbound messages getting Anti-Spam and Anti-Virus scanned (assuming you don't so IronPort Anti-Spam scanning for outbound messages (read relay)). Technically the inbound system volume for an hour will top out at ~25K messages per hour but that's based on the average message size of 15 KB. You can pretty much count that if the average message size is 45 KB that your max volume will top out at ~8K messages.

Traditionally the IronPorts are configured to perform Anti-Virus scanning for outbound messages in which case the performance numbers are around 40K per hour.

So with all that said, if you stick the performance numbers listed above you should be able to have a system processing mail with no delays.

Sincerely,

Jay Bivens
IronPort Systems

yanir_ironport · ‎07-08-2007

Hi

when looking at monitor--system overview-Incoming Messages per hour

is it concludes the just the incoming msg -from public listeners ?

looking at incoming and outgoing mail summary -i can figure out how many msg went throgh the box .

is there any other statistics i can use ?

Yannir

bfayne_ironport · ‎07-14-2007

If you want to do your own benchmarks, two programs that I have used have given me results that ended up very close to what I see with real-world email.

http://www.slamd.com/ (great for LDAP testing)
http://www.coker.com.au/postal/

Postal is a great program and will generate completely random bodies. It gives IPAS a really hard time and very few messages will come up positive. You can then just measure the output and that is usually very close to what you will see in production.

The best way however, is to get a corpus of your own emails, maybe 100k - 250k and shove them at an Ironport. Don't let the workqueue backlog get too high unles you want to test worst-case mail flow as a backed-up workqueue can have a bit of a performance impact.

There is a program called formail (comes with procmail) that can be used to redeliver mbox format into sendmail.

Try this as a command line
formail -s /usr/sbin/sendmail -v -t -oiee < mbox

If you try it with real addresses, be very sure that you either send the mail to an SMTP sink or have a /dev/null SMTP route on your Ironport appliance or you will risk spraying mail all over the place. Very hard to clean up.

That should be enough to get pointed in the right direction.

All the performance testing that I have ever done has been with large Ironports (C60, C650, X1050) so be nice to your C10s.

I realize that all of the above doesn't really help someone who wants to benchmark using a windows box as a source. Fit the tool to the job, not the job to the tool. :)

Eisenhafen · ‎09-27-2007

Hello,

could someone give me an estimate for the current hardware for max. mgs/minute or /day? All features enabled.
-C150
-C350
-C650
How much is the increase compared to the C100/C300/C600?

jbivens_ironport · ‎09-27-2007

-C150 ~150,000 a day
-C350 ~1,000,000 a day
-C650 ~2,000,000 a day

Generally the performance was doubled for the C350 and C650 and almost doubled for the C150. These are just my estimates based on some production performance, of course these volumes can vary based on items like the number of TCP connections etc. etc. Of course these numbers are based on every feature turned on.

Sincerely,

Jay Bivens
IronPort Systems

Mark [CSE]_ironport · ‎10-02-2007

Those numbers are for feature disabled not enabled.

Cheers,

Mark

jbivens_ironport · ‎10-02-2007

Mark,

Actually you are incorrect, these numbers are with all the features turned on and I see it on a frequent basis. As stated the milage will vary based on other factors like DNS performance, TCP concurrent connections, % of TCP connections rejected, and if a Hardware Load Balancer is being utilized. Besides that these numbers should be on the money if the device is configured correctly and there isn't excessive amounts of custom filters running.

Maybe a key note, I consider these numbers to be maximums meaning that the system will probably show message build up in the work queue and maxed out CPU. Don't expect the systems to run at 50% CPU at these levels.

Sincerely,

Jay Bivens
IronPort Systems

Mark [CSE]_ironport · ‎10-03-2007

Oh - yes. This is per day, not per hour - makes sense.

/Mark

jbivens_ironport · ‎10-03-2007

How funny, I was wondering why you would say that, and I thought did he see per day... :^)

Sincerely,

Jay Bivens

kurceitpro_ironport · ‎09-09-2008

-C150 ~150,000 a day 
-C350 ~1,000,000 a day
-C650 ~2,000,000 a day

Generally the performance was doubled for the C350 and C650 and almost doubled for the C150.  These are just my estimates based on some production performance, of course these volumes can vary based on items like the number of TCP connections etc. etc.  Of course these numbers are based on every feature turned on.

Sincerely,

Jay Bivens
IronPort Systems

Helo Jay Bivens, about your statement above, I want to ask u about that. What about the performance of the appliance (C150, C350, C650) when we calculate for Message Per Hour (MPH)? Can I say :
C150 ~ 7,500 MPH
C350 ~ 50,000 MPH
C650 ~ 100,000 MPH
Is that my assumption correct?
And what about the performance of X1050, when we calculate in MPH?

Thanks a lot.
Sincerely,

Kurniawan

jbivens_ironport · ‎09-09-2008


Helo Jay Bivens, about your statement above, I want to ask u about that. What about the performance of the appliance (C150, C350, C650) when we calculate for Message Per Hour (MPH)? Can I say :
C150 ~ 7,500 MPH
C350 ~ 50,000 MPH
C650 ~ 100,000 MPH
Is that my assumption correct?
And what about the performance of X1050, when we calculate in MPH?

The numbers that you're quoting are closer to the Anti-Spam performance numbers and one thing to keep in mind that is that it's based on a 15KB message size with is probably a good message size without Senderbase block but when you start blocking with Senderbase your average message size usually goes up to something like 49-60 KB which means that performance will go down proportionally to that size (with regards to MPH).

Now using the Anti-Spam number is really the best performance gauge because by an large it's the slowest of all the engines however one thing that seems to be creeping into the performance equation (and there really little data to gauge it) is content scanning for compliance (i.e. credit card numbers, social security numbers, etc) and the other variable is going to be TCP connections. Just recently I was at a customer who was hit with a Bounce Blow Back attack on such a scale that it they were literally 10x their normal volume of 5M messages a day so it was quite large and the TCP overhead created a large CPU MTA burden. So just keep this in mind because for small customers TCP really doesn't matter in most cases however in larger accounts (especially ISPs) you need to account for it.

With regards to the 1050 the number is ~250,000 MPH on the spam side.

Sincerely,

Jay Bivens
IronPort Systems