We recently added a large client to our anti-spam system, increasing the load on our servers several times over. Since the client is very important, we started monitoring the servers with Whats Up Gold shortly after. We have two anti-spam virtual servers running Windows 2003 under Hyper-V. Both servers are running v.4.0.1.786 with the latest release version of the anti-virus plugin, 6.1.5.0 I think.

The only issue we had that was visible to the client was that they receive PDF files from many of their own partners, and the spam filter was rejecting these PDFs, until we whitelisted the senders.

On our end, both servers have exhibited steadily increasing memory usage since we started monitoring last week. Then yesterday the SMTP service on server 1 locked up at about 2:40pm. From 14:39 to 15:06 the logs are empty, when the log was spammed with
05/27/09 15:06:26:454 -- (2272) Listen Exception occurred: Thread creation error: Not enough storage is available to process this command
occasionally there is a line like:
05/27/09 23:45:30:510 -- Exception occurred during DumpLog: Cannot open file "C:\Program Files\SpamFilter\logfiles\20090527.log". The process cannot access the file because it is being used by another process
This continued until the server was rebooted.

So to summarize: we are using the latest release version of the Spam Filter witht he AV plugin, there appears to be a memory leak, and there are many PDF files going through the system. I mention the PDFs because a search for "memory leak" revealed a thread with what looks like a similar problem that apparently was resolved.
http://www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=6609&KW=memory+leak&PID=12614#12614

Any suggestions or comments would be welcome

Thanks! I will try setting
SpamPDFMaxPagesToScan=0
and see if that helps

We've been debating over this for the past year internally on how to proceed. On one end we are "stuck" with a PDF library from a 3rd party that we know has a few problems, and can in turn cause problems in SpamFilter, on the other end we have the necessity of being able to allow admins to stop this kind of spam if it presents itself (which it hasn't done in almost a couple of years).

While we've provided users with the solution (disabling the PDF scanning via the ini file setting), this is often a "reaction". SpamFilter crashes a few times (which is of course a bad thing), and the admins may or may not contact us for support. When they do, we (or the support forums) provide the solution. We'd however prefer that SpamFilter would not cause any problems to begin with, and thus would like to remove the PDF functionality until we can obtain a better supported product by our 3rd party provider. I hope you see our dilemma...

We're always open to suggestions, critics, etc., so we'll be happy to hear from your (and other's) opinion on this matter if it can help us better help you all.