Thousands of exim processes freeze the server

[tonyxp]

My server suddently shows thousands of exim processes and it cause server hangs. How to stop this to happen? here is a part of ps -aux shows

mailnull 26838 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26839 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26840 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26841 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26843 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26844 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26845 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26846 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26847 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26849 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26850 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26852 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26853 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26854 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26855 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26858 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26860 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26861 0.0 0.1 6312 1768 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26862 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26863 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26864 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26865 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26866 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26867 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26868 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26869 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26871 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26873 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26874 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26875 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26876 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26877 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26879 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26880 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26881 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26882 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26883 0.0 0.1 6312 1760 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26884 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26885 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i
mailnull 26889 0.0 0.1 6312 1752 ? D 04:40 0:00 /usr/sbin/sendmail -t -i

[tonyxp]

And here is the top shows:

04:49:43 up 1 day, 14:40, 1 user, load average: 659.24, 528.61, 288.50
1859 processes: 1856 sleeping, 2 running, 0 zombie, 1 stopped
CPU states: 3.3% user 16.5% system 0.0% nice 0.0% iowait 80.1% idle
Mem: 1032320k av, 1019488k used, 12832k free, 0k shrd, 1864k buff
376132k active, 509376k inactive
Swap: 2104504k av, 1929084k used, 175420k free 31636k cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
27435 root 16 0 2668 2668 868 R 12.7 0.2 0:15 0 top
5 root 15 0 0 0 0 SW 1.5 0.0 0:18 0 kswapd
20495 mysql 9 0 1955M 392M 5208 S 0.9 38.8 161:17 0 mysqld

[nickn]

Looks like you have a spammer

There's a little snipplet of perl code located at http://www.cpanelfaq.org/003/100.html that might help you


It's basically used in times like this to replace your real sendmail binary and allow you to find your spammer by logging all requests to /var/log/formmail.log

There's a little more feature filled program at http://webhosting-tools.com/view.cgi/MailMon that allows you to limit each user to X amount of mail in X minutes. However, as of right now, it appears the site is down.