exim going crazy, high server load

[horrighs]

I am chasing my tail here and was hoping someone could help me.

My Exim is freaking out. its opening hundredes of extra connections here is the top of top:

08:21:23 up 1 day, 8:21, 2 users, load average: 375.31, 362.00, 300.46
702 processes: 698 sleeping, 2 running, 0 zombie, 2 stopped
CPU states: cpu user nice system irq softirq iowait idle
total 8.3% 0.0% 75.8% 0.0% 0.1% 14.9% 0.5%
cpu00 9.7% 0.0% 77.6% 0.0% 0.1% 12.0% 0.3%
cpu01 7.8% 0.0% 75.6% 0.0% 0.0% 16.4% 0.0%
cpu02 6.5% 0.0% 74.9% 0.0% 0.0% 16.8% 1.6%
cpu03 9.3% 0.0% 75.3% 0.3% 0.3% 14.4% 0.1%
Mem: 1028484k av, 997464k used, 31020k free, 0k shrd, 49548k buff
552620k actv, 70204k in_d, 13800k in_c
Swap: 2048276k av, 144768k used, 1903508k free 133080k cached


of the 702 process like 600 would be exim related, some sendmail. I am guessing this is some type of user either spamming or sending alot of mail but how can i track it down? Looking over the logs there is not one secific person getting/sending crazy amounts of mail that i can see.

[Website Rob]

Although I'm not sure why you say the problem is Exim, you definitely have a problem. I'm surprized the Server is even operating at such a high load -- some services are probably very slow or not working at all.

Your best bet is to reboot the Server to bring things back to managable then have a look at your settings for Apache, mySQL, and WHM, for how many eMails are allowed to be sent per hour.

I've seen other Servers with high loads like this and also noticed they, like you, run IRC. I would take a guess and say that could be the problem, if not mySQL and/or some Perl scripts.

[horrighs]

I dont run IRC, and yes the server is quite slow, it still is resopoding however...

I dont see that we are sending alot of messages per hour but how can i tell?

I did have another server that php mail() command seemed to be leaving exim/sendmail open but all i did was edit the php.ini to /dev/null instead of the correct path to sendmail. I did that on this box to no luck.

Mysql doesnt look to bad, but how can i track down a bad perl script or something? i guess how i can get a list of what userid is sending these messages? that way i could disable offending account at least.

[easyhoster1]

Did you look at the exim logs?

cd /var/log/exim

tail -f mainlog

Also, look at the Apache Status in WHM to give you an idea which site may be using a perl script.

[Doctor]

Originally posted by horrighs
I am chasing my tail here and was hoping someone could help me.

My Exim is freaking out. its opening hundredes of extra connections here is the top of top:

08:21:23 up 1 day, 8:21, 2 users, load average: 375.31, 362.00, 300.46
702 processes: 698 sleeping, 2 running, 0 zombie, 2 stopped
CPU states: cpu user nice system irq softirq iowait idle
total 8.3% 0.0% 75.8% 0.0% 0.1% 14.9% 0.5%
cpu00 9.7% 0.0% 77.6% 0.0% 0.1% 12.0% 0.3%
cpu01 7.8% 0.0% 75.6% 0.0% 0.0% 16.4% 0.0%
cpu02 6.5% 0.0% 74.9% 0.0% 0.0% 16.8% 1.6%
cpu03 9.3% 0.0% 75.3% 0.3% 0.3% 14.4% 0.1%
Mem: 1028484k av, 997464k used, 31020k free, 0k shrd, 49548k buff
552620k actv, 70204k in_d, 13800k in_c
Swap: 2048276k av, 144768k used, 1903508k free 133080k cached


of the 702 process like 600 would be exim related, some sendmail. I am guessing this is some type of user either spamming or sending alot of mail but how can i track it down? Looking over the logs there is not one secific person getting/sending crazy amounts of mail that i can see.

What kernel and OS are you running on?

[Doctor]

Also, what made you so sure it is Exim that is causing such problems? Do you have Mailscanner installed and spam filter enabled?

[horrighs]

I am on:

Linux 2.4.21-4.0.1.ELsmp #1 SMP Thu Oct 23 01:27:36 EDT 2003 i686 i686 i386 GNU/Linux

I am assuming its Exim as that is what is hanging up with hundreds of extra processes.

Steve

[daWeazy]

I have been fighting this issues ever few days.. I think what is going on is that a spammer is flooding the hell out of the smtp service and exim starts to fork proccesses and never stops forking. My exim_reject log just for today is 3megs.. Everytime this problem happens my exim_mainlog and exim_reject log are massive in size. I have setup every spam blocking feature know to man for exim/spamassassin.

What I am doing now is manually iptables/firewalling every address I see in the exim_rejectlog. I am hoping this will help a bit. This issue is due to a spammer flooding your smtp server from multiple hosts. Let me know what you guys think

[horrighs]

check your /etc/valises folder

do a ' grep fail * '

if anyone put a fail in without the two colons like :fail: it could be your problem... or if not fail, :blackhole:

Steve

[daWeazy]

nah I dont think this is the issue but I will watch it.

[wimp]

hi there,
i have the same problem:

http://www.webhostingtalk.com/showth...hreadid=261118

and:
http://www.webhostingtalk.com/showth...hreadid=261804
----
tried to disable spam assassin in WHM (suppose it handle a lot of spams and and generate high server load) but it didn't help.
Then i Enable "Prevent the user 'nobody' from sending out mail to remote addresses" in WHM -> Tweak Settings
Now the server load is going dow at a normal Level. However i can still finde about 5000 mails in queue as the following below. I think there is installed some php script sending spam for server....


-----
1BEtg6-00087C-Pc-H
mailnull 47 12
<>
1082223150 0
-ident mailnull
-received_protocol local
-body_linecount 597
-frozen 1082267923
-localerror
XX
1
03618@host.wproperu.com

151P Received: from mailnull by myserver.domain.com with local (Exim 4.24)
id 1BEtg6-00087C-Pc
for 03618@host.wproperu.com; Sat, 17 Apr 2004 19:32:30 +0200
041 X-Failed-Recipients: u@myserver.domain.com
031 Auto-Submitted: auto-generated
061F Wrom: SQHYUCDDJBLVLMHAALPTCXLYRWTQTIPWIGYOKSTTZRCLBDXRQBGJSNBO
028T To: 03618@host.wproperu.com
059 Subject: Mail delivery failed: returning message to sender
050I Message-Id: <E1BEtg6-00087C-Pc@myserver.domain.com>
038 Date: Sat, 17 Apr 2004 19:32:30 +0200


1BEtg6-00087C-Pc-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

u@myserver.domain.com
Unrouteable address

------ This is a copy of the message, including all the headers. ------

Return-path: <03618@host.wproperu.com>
Received: from [64.76.72.236] (helo=myserver.domain.com)
by myserver.domain.com with esmtp (Exim 4.24)
id 1BEtg3-00086b-MK
for u@myserver.domain.com; Sat, 17 Apr 2004 19:32:27 +0200
Wrom: HMKHJYFMYXOEAIJJPHSCRTN
To: u@myserver.domain.com
Subject: Re: Old photos
Date: Thu, 17 Apr 2003 12:32:57 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0016----=_NextPart_000_0016"
X-Priority: 3
X-MSMail-Priority: Normal
Message-Id: <E1BEtg3-00086b-MK@myserver.domain.com>

This is a multi-part message in MIME format.

------=_NextPart_000_0016----=_NextPart_000_0016
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit

Greetings from france,

your friend.


------=_NextPart_000_0016----=_NextPart_000_0016
Content-Type: application/octet-stream;
name="old_photos_u.scr"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="old_photos_u.scr"
----

[wimp]

afther a few days i can say this has NOT solved the problem.... so i am still fighting against this problem.. Has anyone found a solution?

[Sabaote]

I'm having the same problema..
Im my case.. the load is between 60% and 99%

i'm crazy.. i can't find nothing for help-me...
if somebody knows how to fix.. please..

thanks!

[netlook]

Check the mailscanner and clamscan... On my the high load is becaose those two...

[wimp]

mailscanner and clamscan ? what does this exactly and can those services ben disable??