Hi, I will answer my question. The problem was SARE rules. After removing all SARE related rules, the problem was solved.
Thanks. On Mon, Apr 11, 2011 at 1:53 PM, Ibrahim Harrani <ibrahim.harr...@gmail.com> wrote: > Hi, > > I am running SA 3.3.1 on FreeBSD 8 amd64 > Some of the child process use %100 CPU. When I check the process activity with > truss -p PID, the result is absolutely nothing. lsof displays CLOSED or > CLOSE_WAIT status connections. Here is an example lsof output from a hang > spamd > child. If I restart spamd or kill this process. the cpu load decreases. > There is no error in the log files. this is happening randonly 2-3 > times in a day. > > PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND > 43021 root 1 118 0 178M 147M CPU3 3 121:28 100.00% perl > > > # lsof -p 43021 > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME > perl 43021 mail rtd VDIR 0,90 512 2 / > perl 43021 mail txt VREG 0,92 7152 213112 > /usr/local/bin/perl5.10.1 > perl 43021 mail txt VREG 0,90 246776 800769 > /libexec/ld-elf.so.1 > perl 43021 mail txt VREG 0,92 1636236 237075 > /usr/local/lib/perl5/5.10.1/mach/CORE/libperl.so > perl 43021 mail txt VREG 0,90 154320 471045 > /lib/libm.so.5 > perl 43021 mail txt VREG 0,90 33792 471043 > /lib/libcrypt.so.5 > perl 43021 mail txt VREG 0,90 64856 471050 > /lib/libutil.so.8 > perl 43021 mail txt VREG 0,90 1295416 471042 > /lib/libc.so.7 > perl 43021 mail txt VREG 0,92 29907 237545 > /usr/local/lib/perl5/5.10.1/mach/auto/Socket/Socket.so > perl 43021 mail txt VREG 0,92 24660 237345 > /usr/local/lib/perl5/5.10.1/mach/auto/IO/IO.so > perl 43021 mail txt VREG 0,92 28857 285378 > /usr/local/lib/perl5/site_perl/5.10.1/mach/auto/Socket6/Socket6.so > perl 43021 mail txt VREG 0,92 21204 237327 > /usr/local/lib/perl5/5.10.1/mach/auto/Fcntl/Fcntl.so > perl 43021 mail txt VREG 0,92 122478 237364 > /usr/local/lib/perl5/5.10.1/mach/auto/POSIX/POSIX.so > perl 43021 mail txt VREG 0,92 29249 354309 > /usr/local/lib/perl5/site_perl/5.10.1/mach/auto/Time/HiRes/HiRes.so > perl 43021 mail txt VREG 0,92 11255 237575 > /usr/local/lib/perl5/5.10.1/mach/auto/Sys/Hostname/Hostname.so > perl 43021 mail txt VREG 0,92 19446 237354 > /usr/local/lib/perl5/5.10.1/mach/auto/MIME/Base64/Base64.so > perl 43021 mail txt VREG 0,92 28745 237330 > /usr/local/lib/perl5/5.10.1/mach/auto/File/Glob/Glob.so > perl 43021 mail txt VREG 0,92 34634 401718 > /usr/local/lib/perl5/site_perl/5.10.1/mach/auto/NetAddr/IP/Util/Util.so > perl 43021 mail txt VREG 0,92 69083 401705 > /usr/local/lib/perl5/site_perl/5.10.1/mach/auto/HTML/Parser/Parser.so > perl 43021 mail txt VREG 0,92 12408 285467 > /usr/local/lib/perl5/site_perl/5.10.1/mach/auto/Net/DNS/DNS.so > perl 43021 mail txt VREG 0,92 42618 237290 > /usr/local/lib/perl5/5.10.1/mach/auto/Data/Dumper/Dumper.so > perl 43021 mail txt VREG 0,92 15190 237284 > /usr/local/lib/perl5/5.10.1/mach/auto/Cwd/Cwd.so > perl 43021 mail txt VREG 0,92 35205 237351 > /usr/local/lib/perl5/5.10.1/mach/auto/List/Util/Util.so > perl 43021 mail txt VREG 0,92 56047 237302 > /usr/local/lib/perl5/5.10.1/mach/auto/Digest/SHA/SHA.so > perl 43021 mail txt VREG 0,92 51901 237286 > /usr/local/lib/perl5/5.10.1/mach/auto/DB_File/DB_File.so > perl 43021 mail txt VREG 0,92 28186 285392 > /usr/local/lib/perl5/site_perl/5.10.1/mach/auto/Digest/SHA1/SHA1.so > perl 43021 mail txt VREG 0,92 22327 237578 > /usr/local/lib/perl5/5.10.1/mach/auto/Sys/Syslog/Syslog.so > perl 43021 mail txt VREG 0,92 25741 285502 > /usr/local/lib/perl5/site_perl/5.10.1/mach/auto/Razor2/Preproc/deHTMLxs/deHTMLxs.so > perl 43021 mail txt VREG 0,90 2498211 424313 > /var/db/spamassassin/compiled/5.010/3.003001/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so > perl 43021 mail txt VREG 0,90 11641 424585 > /var/db/spamassassin/compiled/5.010/3.003001/auto/Mail/SpamAssassin/CompiledRegexps/body_500/body_500.so > perl 43021 mail txt VREG 0,92 39291 237543 > /usr/local/lib/perl5/5.10.1/mach/auto/SDBM_File/SDBM_File.so > perl 43021 mail 0r VCHR 0,29 0t0 29 /dev/null > perl 43021 mail 1u PIPE 0xffffff000e53f9e0 0 > ->0xffffff000e53f888 > perl 43021 mail 2u PIPE 0xffffff000e53f9e0 0 > ->0xffffff000e53f888 > perl 43021 mail 3r VREG 0,92 108282 216586 > /usr/local/bin/spamd > perl 43021 mail 4u PIPE 0xffffff000e53f9e0 0 > ->0xffffff000e53f888 > perl 43021 mail 5u IPv4 0xffffff01672cc000 0t0 TCP > localhost.localdomain:783 (LISTEN) > perl 43021 mail 6u unix 0xffffff01677ab000 0t0 ->(none) > perl 43021 mail 7u unix 0xffffff000ec58d48 0t0 ->(none) > perl 43021 mail 8u unix 0xffffff01b6f5e550 0t0 ->(none) > perl 43021 mail 9u unix 0xffffff033f787550 0t0 ->(none) > perl 43021 mail 10u unix 0xffffff02a97afaa0 0t0 > ->0xffffff00644d9aa0 > perl 43021 mail 11u unix 0xffffff03f2f43aa0 0t0 > ->0xffffff04112f6550 > perl 43021 mail 12u unix 0xffffff0050680550 0t0 ->(none) > perl 43021 mail 13u unix 0xffffff0130a8f550 0t0 ->(none) > perl 43021 mail 14u unix 0xffffff0355bd9550 0t0 ->(none) > perl 43021 mail 15u unix 0xffffff032dbf82a8 0t0 ->(none) > perl 43021 mail 16u unix 0xffffff02997b67f8 0t0 ->(none) > perl 43021 mail 17u unix 0xffffff0079b8c7f8 0t0 ->(none) > perl 43021 mail 18u unix 0xffffff03cb9f82a8 0t0 > ->0xffffff0429b127f8 > perl 43021 mail 19u unix 0xffffff0156bb8aa0 0t0 > ->0xffffff0355f3d7f8 > perl 43021 mail 20u unix 0xffffff034cd487f8 0t0 > ->0xffffff02a97ac000 > perl 43021 mail 21u unix 0xffffff02b5d00d48 0t0 > ->0xffffff02b2641d48 > perl 43021 mail 22u IPv4 0xffffff02b2bec000 0t0 TCP > localhost.localdomain:783->localhost.localdomain:52662 (CLOSED) > perl 43021 mail 23u unix 0xffffff03bf97e550 0t0 ->(none) > perl 43021 mail 24u unix 0xffffff0219707d48 0t0 ->(none) > perl 43021 mail 25u unix 0xffffff0187208000 0t0 ->(none) > perl 43021 mail 26u unix 0xffffff03140c87f8 0t0 ->(none) > perl 43021 mail 27u unix 0xffffff03bfdfb2a8 0t0 ->(none) > perl 43021 mail 28u unix 0xffffff03a45e7000 0t0 ->(none) > perl 43021 mail 29u unix 0xffffff02202a2d48 0t0 > ->0xffffff03bf4727f8 > perl 43021 mail 30u unix 0xffffff0050680d48 0t0 > ->0xffffff024286e550 > perl 43021 mail 31u unix 0xffffff006ec9caa0 0t0 > ->0xffffff0130d02d48 > perl 43021 mail 32u unix 0xffffff03ca9b0d48 0t0 > ->0xffffff0355f4f550 > perl 43021 mail 33u unix 0xffffff03140ee7f8 0t0 > ->0xffffff034cd49d48 > perl 43021 mail 34u unix 0xffffff015cada000 0t0 ->(none) > perl 43021 mail 35u unix 0xffffff0220686550 0t0 ->(none) > perl 43021 mail 36u unix 0xffffff0109e0c7f8 0t0 > ->0xffffff0220209aa0 > perl 43021 mail 42u IPv4 0xffffff000e085140 0t0 UDP > mail.mydomain.com:30598->dnsserver.mydomain.com:domain > > > > [43021 ] dbg: FreeMail: header EnvelopeFrom not found from mail > [43021 ] dbg: FreeMail: header EnvelopeFrom not found from mail > [43021 ] dbg: rules: ran eval rule __SUBJ_ILLEGAL_CHARS ======> got hit (1) > [43021 ] dbg: rules: ran eval rule __SUBJ_ILLEGAL_CHARS ======> got hit (1) > [43021 ] dbg: rules: running body tests; score so far=0.6 > [43021 ] dbg: rules: running body tests; score so far=0.6 > > I suspect from SUBJ_ILLEGAL_CHARS then disabled it by setting score > SUBJ_ILLEGAL_CHARS 0. > But the problem is still exist. > > This is a log from another spamd after disabling SUBJ_ILLEGAL_CHARS. > > [37120] dbg: FreeMail: header Reply-To not found from mail > [37120] dbg: FreeMail: RULE (FREEMAIL_ENVFROM_END_DIGIT) > check_freemail_header regex:\d@ > [37120] dbg: FreeMail: RULE (FREEMAIL_ENVFROM_END_DIGIT) > check_freemail_header regex:\d@ > [37120] dbg: FreeMail: header EnvelopeFrom not found from mail > [37120] dbg: FreeMail: header EnvelopeFrom not found from mail > [37120] dbg: rules: running body tests; score so far=0 > [37120] dbg: rules: running body tests; score so far=0 > > > Thanks. >
