Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 10 Jan 2003 21:56:51 +1030
From:      Greg Hurrell <greg@hurrell.cc>
To:        freebsd-isp@FreeBSD.ORG
Subject:   SpamAssassin spawned 700 perl processes
Message-ID:  <6A4FC9DF-248E-11D7-93AF-000393BC25EC@hurrell.cc>

next in thread | raw e-mail | index | archive | help
Weird thing happened today to my mail server (FreeBSD 4.7-RELEASE-p2 
#6: Thu Nov 14 21:42:32 CST 2002).

After 55 days of uptime, the machine suddenly went down like a town of 
bricks. It appears that over a period of several hours,  several 
hundred perl processes built up -- all running either spamc or spamd 
(from SpamAssassin).

Here's the first part of the output of "top -u" which I managed to snag 
before the machine finally died:

> last pid: 47611;  load averages:  2.86,  2.30,  2.29   up 56+14:46:56  
> 12:52:17
> 652 processes: 1 running, 651 sleeping
> CPU states: 51.0% user,  0.0% nice,  8.6% system,  1.0% interrupt, 
> 39.4% idle
> Mem: 329M Active, 36M Inact, 118M Wired, 15M Cache, 60M Buf, 992K Free
> Swap: 1024M Total, 961M Used, 63M Free, 93% Inuse, 48K In, 740K Out
>
>   PID    UID   PRI NICE  SIZE    RES STATE    TIME   WCPU    CPU 
> COMMAND
> 80276      0     2   0  3028K  1192K select   5:38  1.07%  1.07% named
> 44480      0     2   0 24344K  7020K connec   1:06  0.39%  0.39% perl
> 47145      0     2   0 22208K  7268K connec   0:45  0.34%  0.34% perl
> 43834      0     2   0 24832K  7084K connec   1:08  0.29%  0.29% perl
> 44995      0     2   0 24280K  7236K connec   1:02  0.29%  0.29% perl
> 43996      0     2   0 24668K  7032K connec   1:08  0.24%  0.24% perl
> 44841      0     2   0 24724K  7292K connec   1:05  0.24%  0.24% perl
> 44280      0     2   0 24672K  7228K connec   1:07  0.20%  0.20% perl

And here is a partial sample from "ps auxww":

> 1002 44851  0.0  0.0   628    0  ??  IWJ  -         0:00.00 sh -c 
> /usr/bin/spamc
> 1002 44852  0.0  0.0  2268    0  ??  IWJ  -         0:00.00 
> /usr/bin/spamc
> nobody 44853  0.1  1.4 24496 7196  ??  SJ    7:19AM   1:04.03 
> /usr/bin/perl /usr/bin/spamd -x -i 203.2.192.76 -A 203.2.192.76 -r 
> /var/run/spamd.pid -d
> 1002 44875  0.0  0.0   628    0  ??  IWJ  -         0:00.00 sh -c 
> /usr/bin/spamc
> 1002 44876  0.0  0.0  2268    0  ??  IWJ  -         0:00.00 
> /usr/bin/spamc
> nobody 44877  0.0  1.4 24412 7108  ??  SJ    7:24AM   1:03.90 
> /usr/bin/perl /usr/bin/spamd -x -i 203.2.192.76 -A 203.2.192.76 -r 
> /var/run/spamd.pid -d
> 1002 44887  0.0  0.0   628    0  ??  IWJ  -         0:00.00 sh -c 
> /usr/bin/spamc
> 1002 44888  0.0  0.0  2268    0  ??  IWJ  -         0:00.00 
> /usr/bin/spamc
> nobody 44889  0.0  1.4 24292 7100  ??  SJ    7:24AM   1:02.23 
> /usr/bin/perl /usr/bin/spamd -x -i 203.2.192.76 -A 203.2.192.76 -r 
> /var/run/spamd.pid -d

Except of course, that this went on for hundreds and hundreds of 
lines...

The machine eventually got so bogged down that I couldn't even ssh into 
it, although I could still ping it.

After a reboot I disabled spamassassin and now I am looking for answers 
as to why this suddenly occurred after 55 days of uptime (and before 
that, months of trouble-free operation interrupted only by reboots for 
security updates).

What might have caused spamassassin to spawn so many processes?

(By way of information I am running courier with a .courier file 
containing

	| /usr/local/bin/maildrop

and a .mailfilter file containing:

	xfilter "/usr/bin/spamc"

for each mail account on the system. I start *one* spamd process from 
/usr/local/etc/rc.d/spamd.sh at boot time, so I have no idea why I had 
so many of these processes spawn at around 7:20 AM this morning... all 
of them launched by "/usr/bin/perl" which I find to be a little odd!

My /etc/mail/spamassassin/local.cf file contains very little: only this:

> subject_tag [---SPAM---]
> spam_level_char .
> report_header 1
> use_terse_report 1
> defang_mime 0
> header WHITELISTED_DELIVERY_STATUS      From =~ /"Courier mail server 
> at rivendell.unixhosts.net" <\@>/
> describe WHITELISTED_DELIVERY_STATUS    From: indicates delivery 
> status message
> score WHITELISTED_DELIVERY_STATUS       -2.0

...) Any ideas for why this might have happened, and how I can prevent 
it in the future? I don't really want to turn off spamassassin forever 
because I quite like it!

Cheers :-)
Greg


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6A4FC9DF-248E-11D7-93AF-000393BC25EC>