>-----Original Message-----
>From: Predrag Lezaic [mailto:[EMAIL PROTECTED]
>Sent: Saturday, September 04, 2004 6:36 PM
>To: [EMAIL PROTECTED]; users@spamassassin.apache.org
>Subject: RE: spamd eating up CPU
>
>
>> On the spamd 'sticking', it's strange that we're not seeing the
>>same problems you are? It's possible we've loaded other packages not
>
>My spamd spike is not temporary unfortunately. It goes up and
>goes to almost to 100% when the whole server pretty much bogs down. I just
>got home and looked at top and here is what I got:
>
>17:20:41 up 1 day, 2:31, 1 user, load average: 2.72, 1.83, 0.97
>117 processes: 114 sleeping, 3 running, 0 zombie, 0 stopped
>CPU states: cpu user nice system irq softirq
>iowait idle
> total 96.4% 0.0% 3.5% 0.0% 0.0%
>0.0% 0.0%
>Mem: 1031000k av, 919524k used, 111476k free, 0k
>shrd, 180876k
>buff
> 302996k active, 407324k inactive
>Swap: 1052248k av, 11252k used, 1040996k free
> 252144k
>cached
>
> PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME
>CPU COMMAND
>14362 root 16 0 21124 20M 12112 S 94.7 2.0 4:05 0 spamd
>2038 root 19 0 18212 17M 18084 S 3.1 1.7 5:40
>0 httpd13
>
>I restarted spamassasin and tried top again and spamd is still at 92%.
>Restarting it again. Same thing. Now I am running out of ideas. I will
>keep it off for a while.
>
>We did the upgrade from 3.5xxx to 3.7 to 4.0 and then 4.0.1
>all iwithin just a few hours span one after the other. Rene from Webscorpion
>did it for us. It is bizzare I know but I know also that I am not the only
>one. There are people with 4 or more servers with same config and are having
>problem only on some of the machines.
>
>Thank you,
>Predrag
Hmmm, first off those load averages are insane! Somethings certainly
bogging things down and it sure looks like spamd...
Question: You're using the MS/SA Ensim-provided package and you or
Webscorpion hasn't modified anything or tried to upgrade the version of SA
beyond what Ensim provides? If that happened, that's part of the problem
as something isn't set right.
If you find the thread on ev1servers.net's Forums about config'ing
and using the package, some people mistakenly think they need to modify SA
to run all the time instead of allowing Ensim to do the job for them. If
you went into MailScanner.conf and have the SA features turned 'on' vs. the
stock 'off' settings, that could cause this to happen! It's hard to copy
into this thread, best left on that Forum for your reading, but there's a
logical path for the MS/SA package to handle mail and if you modify that
logic - you'll get what you're seeing.
Something like:
Mail In
Sendmail checks against reject list
MailScanner picks it up
MailScanner checks against spam lists and triggers ClamAV
ClamAV scopes the e-mail and tags it if it's bad
MailScanner drops ClamAV
MailScanner tags it if it's clear of virii, but on a blacklist
OTHERWISE -
MailScanner drops and tosses the message at SpamAssassin
SpamAssassin deals with it, tags it if it matches rulesets
SpamAssassin sends it back to sendmail to deliver.
If you tell MailScanner to use SA as well (this isn't turning on
features in the Admin panels, this is command-line modifications), then
it's actually processing and re-processing the same mail and that could
allow a runaway process to stick. Or at the very least, would cause spamd
to have to stay active all the time to handle the looping you've created.
Search for posts by ArtieMcD on this issues in that Forum.
What happens to the logic path above is that instead of MS tossing
it to SA, it calls SA (spamd) to check the mail at the same time. Then
it tosses it back to SA a second time, which confuses the hell out of it
but sucks up resources reprocessing it.
I checked my top, spamd pops in right after MailScanner and then gets
lost - period. So that's where your problem is, it's showing up and staying
with a massive consumption rate. This was constant on 3 boxes I checked,
just to make sure of what I see vs. what you're showing me.
Check your MailScanner and SA configs, methinks something's rotten
in a .conf file somewhere!
David J. Duffner
VP Operations
NWC Corporation
NWCWEB.com
============================================
NWCWEB.com - Your Design & Hosting Solution!
Featuring Ensim Pro/Linux Servers, Hosted
Accounts, Web Design and e-Commerce services
NWC Corporation - Global e-Pay Solutions
============================================
--
Message scanned by MailScanner, and is believed to be clean.
CONFIDENTIALITY NOTICE: This transmission intended for the
specified destination and person. If this is not you, this
e-mail must be deleted immediately. www.nwcweb.com
