[Mimedefang] Extremely high mimedefang CPU usage issues...
px at zeroday.net
Fri Aug 24 19:55:34 EDT 2007
I've been using Sendmail + MIMEDefang + SpamAssassin on linux for
about 6 years now and have never run into an issue like this until
just yesterday. I noticed that only SOME e-mails were sitting in my
Outlook outbox and Outlook was reporting it was unable to connect to
the SMTP server however the e-mail was actually being sent. This
resulted in it continually unknowingly sending the e-mail out to the
intended recipient. I looked on the mail server and the load average
was hovering around 9.0 where it's usually at 0.3 at the highest.
When i noticed this happening i upgraded all aspects of our mail
server thinking i had encountered a bug... I upgraded to the latest
SpamAssasin (3.2.3), the latest MIMEDefang (2.6.3) and the latest
Sendmail (8.14.1) but the issue is still persistent.
Since this upgrade it seems that MimeDefang just isn't functioning
like it used to. I sent myself the GTUBE test to verify it was
detecting and processing spam correctly but the test GTUBE made it
through with no problems.
I'm really not sure where to go from here and was wondering if anybody
could give me ideas of what to check for...
Here's what my sendmail.mc for 8.14.1 looks like:
VERSIONID(`$Id: generic-linux.mc,v 8.1 1999/09/24 22:48:05 gshapiro Exp $')
FEATURE(`enhdnsbl',`bl.spamcop.net',`"Spam blocked see:
`S=unix:/var/spool/MIMEDefang/mimedefang.sock, F=T, T=S:5m;R:5m')
define(`confPRIVACY_FLAGS',`authwarnings novrfy noexpn noverb')
Here's a typical `top` from the linux box:
PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
18341 defang 25 0 35904 35M 2164 R 29.5 0.8 3:52 1 mimedefang.pl
18904 defang 25 0 35080 34M 2164 R 18.8 0.8 1:38 0 mimedefang.pl
17976 defang 25 0 35936 35M 2164 R 16.9 0.8 4:00 0 mimedefang.pl
18527 defang 25 0 35080 34M 2164 R 16.9 0.8 1:56 1 mimedefang.pl
19015 defang 25 0 32844 32M 2164 R 16.9 0.7 0:56 0 mimedefang.pl
mimedefang is always on top when sorted by CPU usage and it's always a
fairly high CPU usage... Those numbers are actually low for what it's
In addition to the version info i provided above, i'm also running perl 5.8.0.
I'm also seeing the following messages in the log file that I didn't
see prior to these issues:
Aug 24 16:53:19 penguin mimedefang-multiplexor: Killing busy
slave 1 (pid 18527): Busy timeout
Aug 24 16:53:19 penguin mimedefang: Error from multiplexor: ERR
Filter timed out - system may be overloaded (consider increasing busy
Aug 24 16:53:19 penguin mimedefang-multiplexor: Reap: slave 1
(pid 18527) exited due to SIGTERM/SIGKILL as expected.
Aug 24 16:53:19 penguin mimedefang-multiplexor: Slave 1
resource usage: req=2, scans=2, user=205.560, sys=0.330, nswap=0,
majflt=601, minflt=11579, maxrss=0, bi=0, bo=0
Please let me know if i may provide additional information. I'm at a
loss for what to do...
More information about the MIMEDefang