spamd eating memory and cpu, load averages > 2

[heath]

On my server, spamd is constantly eating memory and CPU times, shooting my load average over 2. I've installed the dictionary attack blocker talked about here, but it still isn't helping. I only have about 4 small sites on my server so this shouldn't be happening. Here is a show of top:

13:20:16 up 20 days, 14:02, 1 user, load average: 2.22, 2.11, 2.05
105 processes: 100 sleeping, 2 running, 3 zombie, 0 stopped
CPU states: 20.3% user 2.7% system 0.0% nice 0.0% iowait 76.8% idle
Mem: 505716k av, 500260k used, 5456k free, 0k shrd, 2140k buff
300836k actv, 65432k in_d, 10756k in_c
Swap: 1052248k av, 526124k used, 526124k free 25244k cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
26461 mailnull 15 0 528 256 180 S 99.9 0.0 1:17 0 exim
12608 planproj 16 0 27204 19M 1416 S 7.9 3.9 1:14 0 spamd
12300 planproj 16 0 27240 19M 1444 S 7.3 3.9 1:14 0 spamd
28267 root 21 0 3680 3680 2664 S 1.9 0.7 0:00 0 exim
28258 root 21 0 3684 3684 2664 S 1.7 0.7 0:00 0 exim
12425 planproj 15 0 422M 241M 12 D 1.5 48.8 2:44 0 spamd


Any ideas? This is really bad...

[chirpy]

The problem is probably that you are memory thrashing - that is you're server has basically run out of physical RAM and is continuously swapping memory pages to the swapfile and back. This is seems evident from your swapfile usage that you've quoted and from the spamd process that has consumed 241M of memory.

When you are in top, try pressing M (that's shift-m) to sort by memory usage. That should give you an idea of what's eating it all up, though it's quite clear that is is SpamAssassin.

You might want to disable SpamAssassin which consumes considerable memory by unchecking WHM > Service Manager > spamd and WHM > Tweak Settings > SpamAssassin and then investigating what is causing it to bloom like that.

[DavidR]

I was running quite smoothly until about 3/29, when spamd began eating memory more and more. My server started running out of memory and crashing. I'm still not sure why as the email loads and all other activity look to be about the same. I "think" it corresponds to a cPanel upgrade (Release) but I haven't been able to track that down yet. At someone elses suggestion, I installed the spamd startup config addon and set Maximum Children to 2, leaving the other options blank. After it restarted exim, the loads went down to almost normal again. Give it a try and see if it helps.

David

[heath]

Hi,

Where did you get this startup config editor for spamd?

Also, is there anything else I can do besides removing spamassassin? I keep getting dictionary attacks it looks like, rather than a lot of spam emails. Would removing spamassassin solve this issue?

[heath]

I think I figured out the problem. All unrouted email for one of my domains was getting sent to a default address, so dictionary attacks were all looked at by the spam daemon. Once I blackhole'd the default address, the spam daemon no longer looks at those emails.... hopefully my load avg will go down now.

[DavidR]

Originally Posted by heath

Hi,

Where did you get this startup config editor for spamd?

Also, is there anything else I can do besides removing spamassassin? I keep getting dictionary attacks it looks like, rather than a lot of spam emails. Would removing spamassassin solve this issue?

Go to WHM, it's in Cpanel > Addon Scripts with all the other addons from cpanel. It did so much to improve my situation, I would suggest that anyone using SA install it and read up on the settings at spamassassin.org. In my case, just the one setting above did the trick. Good luck.

David

[chirpy]

Originally Posted by heath

I think I figured out the problem. All unrouted email for one of my domains was getting sent to a default address, so dictionary attacks were all looked at by the spam daemon. Once I blackhole'd the default address, the spam daemon no longer looks at those emails.... hopefully my load avg will go down now.

Be sure to use :fail: and not :blackhole: you can also find a dictionary attack ACL to further reduce the harm that they do here:
http://www.configserver.com/free/eximdeny.html

[AlexAT]

Originally Posted by DavidR

At someone elses suggestion, I installed the spamd startup config addon and set Maximum Children to 2, leaving the other options blank. After it restarted exim, the loads went down to almost normal again. Give it a try and see if it helps.
David

I also install this module and when I log in as reseller to its WHM I was suprised by seeing that this module accessible from reseller WHM and reseller can change values there.

[anup123]

Originally Posted by AlexAT

I also install this module and when I log in as reseller to its WHM I was suprised by seeing that this module accessible from reseller WHM and reseller can change values there.

list of MAJOR WHM/cpanel BUGS

No response
bugzilla ..... don't see any use if one has to post it there come back to forum and then restart it again asking forum visitors to visit bugzilla entry... vote for it. Utterly painful.

[noimad1]

Originally Posted by DavidR

Go to WHM, it's in Cpanel > Addon Scripts with all the other addons from cpanel. It did so much to improve my situation, I would suggest that anyone using SA install it and read up on the settings at spamassassin.org. In my case, just the one setting above did the trick. Good luck.

David

How do you use this startup script editor? I've installed it, but can't find out how to use it. I've searched the forums and come up empty? Is there documentation anywhere for this one?

[noimad1]

Originally Posted by noimad1

How do you use this startup script editor? I've installed it, but can't find out how to use it. I've searched the forums and come up empty? Is there documentation anywhere for this one?

can anyone tell me how to use this script?

[Spiral]

I'd check the Bayes and Autowhitelist databases for each site and make
sure that you don't have one or more that have grown massively huge.

Every so often, you need to truncate and reset those files else they get
big and slow down your Spamassassin scans as well as eat a lot of memory.

[noimad1]

Originally Posted by Spiral

I'd check the Bayes and Autowhitelist databases for each site and make
sure that you don't have one or more that have grown massively huge.

Every so often, you need to truncate and reset those files else they get
big and slow down your Spamassassin scans as well as eat a lot of memory.

Shouldn't this be something that Spamassasin maintains itself? What is the beset way to truncate those files. For example, I have one site that is 45mb. I don't know if that is excessive in size or not. But how do I truncate that file?

Whould there be a way to write a script to automatically do this?

[noimad1]

Spiral,

Whats the best way to "truncate" and reset those files?

[ispro]

Use the following code:

for P in `find /home*/*/.spamassassin/ -name "bayes_toks" -size +10240k | xargs -i echo {}`; do PP=`echo $P|sed s/bayes_toks//`; cat /dev/null > $PP"bayes_journal"; cat /dev/null > $PP"bayes_seen"; cat /dev/null > $PP"bayes_toks"; done;

We are using this code and it works well. It remove the Bayes databases if the main dictionary file over 10 Mb.