[Mimedefang] MIMEDefang crash

[Andrew_Hoying at blm.gov]

Hello,

At around 11:30 today I had a large spike in incoming spam messages, about
400 received in a few minutes. I have had spikes like this in the past
without any problems, but this time MIMEDefang died. I am running
MIMEDefang 2.39 with SpamAssassin 2.61 and no virus scanning. Here is what
I see in my logs:

Jan  8 11:37:42 xx mimedefang-multiplexor: Starting slave 27 (pid 3635) (19
running): About to perform scan
Jan  8 11:37:43 xx mimedefang[5888]: MIMEDefang-2.39: thread_create()
failed: 11, try again
Jan  8 11:37:44 xx sendmail[3642]: i08Ibh67003642: Milter (mimedefang):
read returned -1: Connection reset by rwcrmhc12.comcast.net
Jan  8 11:37:44 xx sendmail[3642]: i08Ibh67003642: Milter (mimedefang): to
error state
Jan  8 11:37:44 xx sendmail[3642]: i08Ibh67003642: Milter (mimedefang):
init failed to open
Jan  8 11:37:44 xx sendmail[3642]: i08Ibh67003642: Milter (mimedefang): to
error state
Jan  8 11:37:44 xx sendmail[3642]: i08Ibh67003642: Milter: initialization
failed, temp failing commands

SAR for that period shows, the system usually runs at 3 percent:
11:20:00 AM       CPU     %user     %nice   %system     %idle
11:30:00 AM       all      6.52      0.00      0.66     92.82
11:40:00 AM       all     17.98      0.00      1.66     80.36
11:50:00 AM       all      2.57      0.00      2.17     95.26

11:20:00 AM kbmemfree kbmemused  %memused kbmemshrd kbbuffers  kbcached
kbswpfree kbswpused  %swpused
11:30:00 AM   1051652   2830276     72.91         0    435292   1660516
4223320      1732      0.04
11:40:00 AM    488788   3393140     87.41         0    435996   1669564
4223320      1732      0.04
11:50:00 AM   1158544   2723384     70.16         0    436084   1684768
4223320      1732      0.04

It looks like a memory problem from this information, is that a correct
guess? In the past I've had up to 40 slaves running at the same time on
spikes without running out of memory, so is something else going on? The
box has 4GB of ram and 2 2.4GHz processors and handles about 15K messages a
day.

Thank you,
Andrew Hoying