[Mimedefang] Extremely high mimedefang CPU usage issues...

[Jason Z]

I've been using Sendmail + MIMEDefang + SpamAssassin on linux for
about 6 years now and have never run into an issue like this until
just yesterday.  I noticed that only SOME e-mails were sitting in my
Outlook outbox and Outlook was reporting it was unable to connect to
the SMTP server however the e-mail was actually being sent.  This
resulted in it continually unknowingly sending the e-mail out to the
intended recipient.  I looked on the mail server and the load average
was hovering around 9.0 where it's usually at 0.3 at the highest.

When i noticed this happening i upgraded all aspects of our mail
server thinking i had encountered a bug... I upgraded to the latest
SpamAssasin (3.2.3), the latest MIMEDefang (2.6.3) and the latest
Sendmail (8.14.1) but the issue is still persistent.

Since this upgrade it seems that MimeDefang just isn't functioning
like it used to.  I sent myself the GTUBE test to verify it was
detecting and processing spam correctly but the test GTUBE made it
through with no problems.

I'm really not sure where to go from here and was wondering if anybody
could give me ideas of what to check for...

Here's what my sendmail.mc for 8.14.1 looks like:
divert(-1)
divert(0)dnl
VERSIONID(`$Id: generic-linux.mc,v 8.1 1999/09/24 22:48:05 gshapiro Exp $')
OSTYPE(linux)dnl
DOMAIN(generic)dnl
FEATURE(`enhdnsbl',`bl.spamcop.net',`"Spam blocked see:
http://spamcop.net/bl.shtml?"$&{client_addr}',`t')dnl
FEATURE(`dnsbl', `sbl-xbl.spamhaus.org')
MASQUERADE_AS(`domainname.com')
FEATURE(`allmasquerade')
INPUT_MAIL_FILTER(`mimedefang',
`S=unix:/var/spool/MIMEDefang/mimedefang.sock, F=T, T=S:5m;R:5m')
define(`ALIAS_FILE',`/etc/mail/aliases')
define(`confMAX_MESSAGE_SIZE',`8000000')
define(`confPRIVACY_FLAGS',`authwarnings novrfy noexpn noverb')
define(`confTO_IDENT',`1s')
define(`confFORWARD_PATH',`')
define(`confLOG_LEVEL',`12')
define(`confMILTER_LOG_LEVEL',`1')dnl
MAILER(local)dnl
MAILER(smtp)dnl

Here's a typical `top` from the linux box:
  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME CPU COMMAND
18341 defang    25   0 35904  35M  2164 R    29.5  0.8   3:52   1 mimedefang.pl
18904 defang    25   0 35080  34M  2164 R    18.8  0.8   1:38   0 mimedefang.pl
17976 defang    25   0 35936  35M  2164 R    16.9  0.8   4:00   0 mimedefang.pl
18527 defang    25   0 35080  34M  2164 R    16.9  0.8   1:56   1 mimedefang.pl
19015 defang    25   0 32844  32M  2164 R    16.9  0.7   0:56   0 mimedefang.pl

mimedefang is always on top when sorted by CPU usage and it's always a
fairly high CPU usage... Those numbers are actually low for what it's
been.

In addition to the version info i provided above, i'm also running perl 5.8.0.

I'm also seeing the following messages in the log file that I didn't
see prior to these issues:

Aug 24 16:53:19 penguin mimedefang-multiplexor[17303]: Killing busy
slave 1 (pid 18527): Busy timeout
Aug 24 16:53:19 penguin mimedefang[17315]: Error from multiplexor: ERR
Filter timed out - system may be overloaded (consider increasing busy
timeout)
Aug 24 16:53:19 penguin mimedefang-multiplexor[17303]: Reap: slave 1
(pid 18527) exited due to SIGTERM/SIGKILL as expected.
Aug 24 16:53:19 penguin mimedefang-multiplexor[17303]: Slave 1
resource usage: req=2, scans=2, user=205.560, sys=0.330, nswap=0,
majflt=601, minflt=11579, maxrss=0, bi=0, bo=0

Please let me know if i may provide additional information.  I'm at a
loss for what to do...