I keep running out of memory every now and again. What's happening?

If you're using spamassassin to filter all mail on your domain, you will run out of memory, unless you impose a limit on simultaneous scans.

Basically, many MTAs (mail transfer agents) will allow unlimited simultaneous deliveries to local mail accounts. If you then start a process to handle each of those deliveries – as you will if you insert SpamAssassin into the delivery process – those processes will chew up RAM and bog down the system.

Many spammers do not impose any kind of rate-throttling on their sending side; they just want to send as much spam as quickly as possible. If the receiving system breaks, that's not their problem.

SpamAssassin is quite a heavyweight filter, so it's more likely to happen with SA running; but would probably happen with any filter if you're not careful.

To avoid this, you should (a) use "spamd", which is more suited for heavy use than the "spamassassin" script, and (b) impose a limit on concurrent "spamd" processes using the "-m" switch.

Finally, if you are using an MTA like Postfix that allows control over how many concurrent local deliveries to allow, set that to a sane number; for example, Postfix allows you to specify a limit of 5 local deliveries at once by adding this line to "main.cf":

   local_destination_concurrency_limit = 5

This helps throttle down the load further upstream, and is very beneficial.

You should also ensure you do not scan very large mails, as described in SpamdKillingServer.

You should also avoid using very large custom rules files. The larger custom rules files available from the SA community will exacerbate this problem. A prime example is sa-blacklist.cf or sa-blacklist-uri.cf by Bill Stearns (See CustomRulesets). If you have memory problems using these rulesets, consider using [http://wiki.apache.org/spamassassin/SURBL] instead.