I can attest to the same situation on two different servers, both
debian woody, happening since two days ago. The load avg on one was @
60.
What's bizarre is that spamassassin was doing fine for a few months
before this.
Very DoS like. Spambombs? exploits? Anybody gotta guess?
-l
Rob Bos in message [SAtalk] spamd frozen? (Thu, 01/09 10:42):
>
> I'm not quite sure how to describe this problem; if I could, I'd
> probably have it solved. So I'll go into the symptoms.
>
> For about a year spamassassin has worked pretty much flawlessly, with
> the occasional hiccup attributable to my own mistakes.
>
> I run spamassassin from qmail-scanner as email gets stuffed into the
> qmail queue; spamassassin 2.43, daemonized. Here's my local.cf:
>
> rewrite_subject 0
> skip_rbl_checks 1
> use_terse_report 1
> report_header 1
> spam_level_char x
> defang_mime 0
>
> I'm running Debian, mostly woody, but with some stuff from sid,
> including libc6. I haven't done any upgrades in the last week or so,
> during which spamassassin has run quite happily. I upgraded to
> linux-2.4.20 last week sometime as well, but with no major config
> changes - I added USB support, but the module wasn't loaded.
> perl version 5.6.1 (debian revision 8.2).
>
> This morning I woke up with a system load around thirty; my tcpserver (I
> run qmail) smtp process having spawned the maximum number of child
> processes, and (because of the high load) dozens of gotmail processes
> running, and duplicate emails being sent because of it.
>
> looking at my process listing, something similar to this was seen, but
> multiplied by thirty or so:
>
> qmaild 446 0.0 0.0 1268 484 ? S 10:16 0:00 /usr/bin/tcpserver -R
>-H -u 64011 -g 65534 -v -x /etc/tcp.smtp.cdb 0 smtp /usr/sbin/relay-ctrl-check
>/usr/sbin/qmail-smtpd
> root 3752 0.0 0.0 1356 460 ? S 10:26 0:00 \_
>/usr/sbin/qmail-smtpd
> qmailq 4065 0.0 0.6 4900 3616 ? S 10:26 0:00 | \_ /usr/bin/perl
>/usr/local/bin/qmail-scanner-queue.pl
> root 4634 0.0 0.0 1288 300 ? S 10:29 0:00 \_
>/usr/sbin/qmail-smtpd
> root 4986 0.2 0.0 1356 460 ? S 10:30 0:00 \_
>/usr/sbin/qmail-smtpd
> qmailq 4990 5.0 0.7 4976 3804 ? S 10:30 0:00 \_ /usr/bin/perl
>/usr/local/bin/qmail-scanner-queue.pl
> qmailq 4994 0.0 0.1 2108 1020 ? S 10:30 0:00 \_ sh -c
>/usr/bin/spamc -f < /var/spool/qmailscan/working/new/neko10421370514244990
> qmailq 4995 0.3 0.1 1860 532 ? S 10:30 0:00 \_
>/usr/bin/spamc -f
>
> none of the spamc processes seemed to be letting go of control.
> Curious. spamd isn't forking subprocesses either.
>
> There were no error messages of note in the log files.
>
> I killed spamd, and waited a few minutes for the dust to clear, to at
> least allow email to go through.
>
> Restarting spamassassin made mail start to back up again, with the same
> problem. spamc wouldn't complete; spamd isn't spawning any subdaemons
> to handle the requests, it appears.
>
> I telnetted to the spamd port. It's listening. Typed in some random
> stuff. No errors, but I don't know the spamd protocol.
>
> On a hunch I backed up and deleted the autowhitelist file, since it had
> (!!) ballooned up to six megabytes.
>
> Also turned off the autowhitelist option in /etc/default/spamassassin:
>
> OPTIONS="-i 127.0.0.1"
>
> Out of ideas, I rebooted my machine. Still no dice.
>
> Any suggestions?
>
> I have it turned off for the interim, and I've got a few unhappy users
> because of it. :)
>
> --
> Rob Bos, rbos@{novylen.net,constainia.net}, upstanding atheist
>
> "Goodbye, goodbye,
> I don't care
> If I never taste your fine food again,
> neutral fellows, seers of every side.
> Tolerance, what crimes
> are committed in your name."
> -- Denise Levertov, _Goodbye To Tolerance_
-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
