From owner-freebsd-questions@FreeBSD.ORG Wed Feb 27 17:20:41 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E9B9B1065676 for ; Wed, 27 Feb 2008 17:20:41 +0000 (UTC) (envelope-from bsilver@chrononomicon.com) Received: from trans-warp.net (hyperion.trans-warp.net [216.37.208.37]) by mx1.freebsd.org (Postfix) with ESMTP id A6CEE8FC25 for ; Wed, 27 Feb 2008 17:20:33 +0000 (UTC) (envelope-from bsilver@chrononomicon.com) Received: from [127.0.0.1] (unverified [65.193.73.208]) by trans-warp.net (SurgeMail 3.8f2) with ESMTP id 159202024-1860479 for multiple; Wed, 27 Feb 2008 12:20:24 -0500 Message-ID: <47C59BDF.7020607@chrononomicon.com> Date: Wed, 27 Feb 2008 12:20:31 -0500 From: Bart Silverstrim User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: Mark Tinguely References: <200802271715.m1RHFSxV053997@casselton.net> In-Reply-To: <200802271715.m1RHFSxV053997@casselton.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-User: bsilver@chrononomicon.com Cc: freebsd-questions@freebsd.org Subject: Re: sudden peak in load average X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Feb 2008 17:20:42 -0000 Mark Tinguely wrote: >> Is it possible that there's a message in your queue that's *being >> processed*, so it may have arrived earlier than near that time and >> causes the spike? > > Bart is correct that the SA processing occurs before sendmail log entry. > > Lately, I have had problems with the latest spamass-milter. Occasionally, > something is forking off another spamass-milter and the original one is > in some tight loop eating processor time. I am not sure if it is the newer > spamass-milter or the fact that I also added the dkim-milter into the mix. > > FYI: > I sent to the original questioner a crude C program to monitor his current > loadaverage. This monitor will save the output of the command "ps -aux" to > a timestamped temporary file when the current loadaverage exceeds a defined > amount (15.0). Another thing to look at would be the output of something like lsof, so that if it is spamassassin, maybe there's a possibility that it could be narrowed down to a particular temporary file unless there's another way to see if there's a particular message chewing away on SA's analysis? It doesn't take a big message to skew SA asunder if it has the right bit of information in it...