[Mimedefang] Mimedefang + SA go crazy !

Gary Funck gary at intrepid.com
Sun Jan 15 13:04:51 EST 2006


> From: ms at interspace.net
> Sent: Sunday, January 15, 2006 12:22 AM
> To: mimedefang
> Subject: [Mimedefang] Mimedefang + SA go crazy !
> 
> 
> hi,
> 
> Now that i upgraded to SA 3.1 I have new problems.
> Today (sunday) SA started consuming all cpu resorces!!
> It opens threads/proccesses and use up to 98% cpu!!!! WTF???
> Sometimes only one instance of SA will use 98% cpu?!?!?
> SA is called from mimedefang-filter (i don't run spamd).
> 

When you type 'ps -u defang', do you actually see instances of
spamassassin, or are you talking about instances of mimedefang.pl
that you happen to know are calling SA internally?  If you see
actual instances of spamassassin, spamd, or spamc running, then
you have a configuration error that you need to chase down.

As far as being cpu bound ... SA is a cpu hungry program.  So, when
SA runs (via mimedefang) it will take all the cpu that it can get,
at least for a second/two.  Thus, while it is scanning a mail, it
can peg the cpu usage meter.

Make sure you check your mimedefang filter -- it should not be calling
SA on large messages (say messages greater than 100K).

> I don't have to say that this is cuasing big problems for me and 
> the company...
> I also noticed (using top) that the spamassassin proccess are invoked by
> 'regular' users of the mailserver , eh?? (the local delivery mailbox
> users...non of them has shell access...)

They may not have shell access, but procmail may be invoked via
sendmail as a local delivery agent, and the global (or per-user)
procmailrc file may be (incorrectly) invoking SA directly.

Take a look at your sendmail.mc file to see if procmail is
configured as a local delivery agent.  If you've got stuff like
this in sendmail.mc, then you are likely invoking procmail:

define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
MAILER(procmail)dnl

In that case, you should take a look to see if there is a
global /etc/procmailrc file, or per-user $USER/.procmailrc
file.  You should also check each user home directory for
a .forward file to see if (and how) it is invoking procmail
(or some other mail filing program).

> also...when cpu is not used by 'user' or 'sys' then the 'wait' 
> state has the
> ~90% instead of 'idle' why is that so?

Don't know, but maybe it is waiting for network I/O or
DNS lookups.

Try typing 'md-mx-ctrl load' when the system is busy, for some
additional info.




More information about the MIMEDefang mailing list