Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 10 Jan 2003 07:03:17 -0500
From:      "Jeff Palmer" <scorpio@drkshdw.org>
To:        <freebsd-isp@FreeBSD.ORG>
Subject:   RE: SpamAssassin spawned 700 perl processes
Message-ID:  <000001c2b8a0$461f26c0$0201a8c0@scorpio>
In-Reply-To: <6A4FC9DF-248E-11D7-93AF-000393BC25EC@hurrell.cc>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
Seems yesterday that razor, razor2 and pyzor were down.
The current thinking on the SA mailing lists,   is that the razor
timeout setting was uneffective.

There has been a work-around implemented in 2.50 (due any time now)
which should eliminate this problem in the future should the situation
arise again.


Jeff Palmer
scorpio@drkshdw.org


> -----Original Message-----
> From: owner-freebsd-isp@FreeBSD.ORG
[mailto:owner-freebsd-isp@FreeBSD.ORG]
> On Behalf Of Greg Hurrell
> Sent: Friday, January 10, 2003 6:27 AM
> To: freebsd-isp@FreeBSD.ORG
> Subject: SpamAssassin spawned 700 perl processes
> 
> Weird thing happened today to my mail server (FreeBSD 4.7-RELEASE-p2
> #6: Thu Nov 14 21:42:32 CST 2002).
> 
> After 55 days of uptime, the machine suddenly went down like a town of
> bricks. It appears that over a period of several hours,  several
> hundred perl processes built up -- all running either spamc or spamd
> (from SpamAssassin).
> 
> Here's the first part of the output of "top -u" which I managed to
snag
> before the machine finally died:
> 
> > last pid: 47611;  load averages:  2.86,  2.30,  2.29   up
56+14:46:56
> > 12:52:17
> > 652 processes: 1 running, 651 sleeping
> > CPU states: 51.0% user,  0.0% nice,  8.6% system,  1.0% interrupt,
> > 39.4% idle
> > Mem: 329M Active, 36M Inact, 118M Wired, 15M Cache, 60M Buf, 992K
Free
> > Swap: 1024M Total, 961M Used, 63M Free, 93% Inuse, 48K In, 740K Out
> >
> >   PID    UID   PRI NICE  SIZE    RES STATE    TIME   WCPU    CPU
> > COMMAND
> > 80276      0     2   0  3028K  1192K select   5:38  1.07%  1.07%
named
> > 44480      0     2   0 24344K  7020K connec   1:06  0.39%  0.39%
perl
> > 47145      0     2   0 22208K  7268K connec   0:45  0.34%  0.34%
perl
> > 43834      0     2   0 24832K  7084K connec   1:08  0.29%  0.29%
perl
> > 44995      0     2   0 24280K  7236K connec   1:02  0.29%  0.29%
perl
> > 43996      0     2   0 24668K  7032K connec   1:08  0.24%  0.24%
perl
> > 44841      0     2   0 24724K  7292K connec   1:05  0.24%  0.24%
perl
> > 44280      0     2   0 24672K  7228K connec   1:07  0.20%  0.20%
perl
> 
> And here is a partial sample from "ps auxww":
> 
> > 1002 44851  0.0  0.0   628    0  ??  IWJ  -         0:00.00 sh -c
> > /usr/bin/spamc
> > 1002 44852  0.0  0.0  2268    0  ??  IWJ  -         0:00.00
> > /usr/bin/spamc
> > nobody 44853  0.1  1.4 24496 7196  ??  SJ    7:19AM   1:04.03
> > /usr/bin/perl /usr/bin/spamd -x -i 203.2.192.76 -A 203.2.192.76 -r
> > /var/run/spamd.pid -d
> > 1002 44875  0.0  0.0   628    0  ??  IWJ  -         0:00.00 sh -c
> > /usr/bin/spamc
> > 1002 44876  0.0  0.0  2268    0  ??  IWJ  -         0:00.00
> > /usr/bin/spamc
> > nobody 44877  0.0  1.4 24412 7108  ??  SJ    7:24AM   1:03.90
> > /usr/bin/perl /usr/bin/spamd -x -i 203.2.192.76 -A 203.2.192.76 -r
> > /var/run/spamd.pid -d
> > 1002 44887  0.0  0.0   628    0  ??  IWJ  -         0:00.00 sh -c
> > /usr/bin/spamc
> > 1002 44888  0.0  0.0  2268    0  ??  IWJ  -         0:00.00
> > /usr/bin/spamc
> > nobody 44889  0.0  1.4 24292 7100  ??  SJ    7:24AM   1:02.23
> > /usr/bin/perl /usr/bin/spamd -x -i 203.2.192.76 -A 203.2.192.76 -r
> > /var/run/spamd.pid -d
> 
> Except of course, that this went on for hundreds and hundreds of
> lines...
> 
> The machine eventually got so bogged down that I couldn't even ssh
into
> it, although I could still ping it.
> 
> After a reboot I disabled spamassassin and now I am looking for
answers
> as to why this suddenly occurred after 55 days of uptime (and before
> that, months of trouble-free operation interrupted only by reboots for
> security updates).
> 
> What might have caused spamassassin to spawn so many processes?
> 
> (By way of information I am running courier with a .courier file
> containing
> 
> 	| /usr/local/bin/maildrop
> 
> and a .mailfilter file containing:
> 
> 	xfilter "/usr/bin/spamc"
> 
> for each mail account on the system. I start *one* spamd process from
> /usr/local/etc/rc.d/spamd.sh at boot time, so I have no idea why I had
> so many of these processes spawn at around 7:20 AM this morning... all
> of them launched by "/usr/bin/perl" which I find to be a little odd!
> 
> My /etc/mail/spamassassin/local.cf file contains very little: only
this:
> 
> > subject_tag [---SPAM---]
> > spam_level_char .
> > report_header 1
> > use_terse_report 1
> > defang_mime 0
> > header WHITELISTED_DELIVERY_STATUS      From =~ /"Courier mail
server
> > at rivendell.unixhosts.net" <\@>/
> > describe WHITELISTED_DELIVERY_STATUS    From: indicates delivery
> > status message
> > score WHITELISTED_DELIVERY_STATUS       -2.0
> 
> ...) Any ideas for why this might have happened, and how I can prevent
> it in the future? I don't really want to turn off spamassassin forever
> because I quite like it!
> 
> Cheers :-)
> Greg
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-isp" in the body of the message




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message




Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?000001c2b8a0$461f26c0$0201a8c0>