From owner-freebsd-questions@FreeBSD.ORG Wed Feb 27 15:58:23 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 986CB106566B for ; Wed, 27 Feb 2008 15:58:23 +0000 (UTC) (envelope-from bsilver@chrononomicon.com) Received: from trans-warp.net (hyperion.trans-warp.net [216.37.208.37]) by mx1.freebsd.org (Postfix) with ESMTP id 492988FC17 for ; Wed, 27 Feb 2008 15:58:23 +0000 (UTC) (envelope-from bsilver@chrononomicon.com) Received: from [127.0.0.1] (unverified [65.193.73.208]) by trans-warp.net (SurgeMail 3.8f2) with ESMTP id 159187137-1860479 for multiple; Wed, 27 Feb 2008 10:42:11 -0500 Message-ID: <47C584D9.4080409@chrononomicon.com> Date: Wed, 27 Feb 2008 10:42:17 -0500 From: Bart Silverstrim User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: Zbigniew Szalbot References: <94136a2c0802270259i313331dcw45f8c26801f01636@mail.gmail.com> <200802271347.m1RDl5mh036977@casselton.net> <94136a2c0802270739p33846331l47a2c63f310e1c37@mail.gmail.com> In-Reply-To: <94136a2c0802270739p33846331l47a2c63f310e1c37@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-User: bsilver@chrononomicon.com Cc: Mark Tinguely , freebsd-questions@freebsd.org Subject: Re: sudden peak in load average X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Feb 2008 15:58:23 -0000 Zbigniew Szalbot wrote: > Hello, > > 2008/2/27, Mark Tinguely : >> > >From the MRTG data I can see that suddenly on a currently not very >> > busy machine the load averege went over 15 or more. This happened >> > around 10 in the morning. Not many entries in httpd access log, smtp >> > server was not too much loaded (at that time it generally produces a >> > load average of about 1). >> >> >> By any chance, do you run SpamAssassin? I have seen load average bursts with >> SA. It seems to me that spam sites are bursting spam to attempt to bring >> down the anti-spam filters. >> >> As mentioned by others a "ps" (or I prefer "pstree") list will help >> solve the issue. > > Thanks. I do have SA but I studied the logs carefully and no outside > connections, except for one with a vary small message desitined for > mailman subscription arrived at around that time. Is it possible that there's a message in your queue that's *being processed*, so it may have arrived earlier than near that time and causes the spike? What tests is SA running? Or something with your DNS settings that is holding up SA while trying to look something up?