i mount the /tmp and i got this disk full and i cant upload any files into the server anymore.
-rw-r--r-- 1 root root 524288000 Apr 15 03:49 tmpDSK
i tried to delete it and get read only message, anyone know how to fix it ?
i mount the /tmp and i got this disk full and i cant upload any files into the server anymore.
-rw-r--r-- 1 root root 524288000 Apr 15 03:49 tmpDSK
i tried to delete it and get read only message, anyone know how to fix it ?
cd /tmp
and remove the garbage out of there
you can remove the session files safely
rm -rf sess*
Lowest Host/Empire Technology LLC
Affordable hosting solutions http://empire-hosting.net
List Your hosting site FREE in http://hostgeneration.com
i did but cant, it says Read-only file system
he said it above
root@watr [/tmp]# rm -rf sess*
rm: cannot remove `sess_0d8e3393f4d681eaa1082de2b5250820': Read-only file system
rm: cannot remove `sess_0fc0ca37b5e39033317ee903d796dc27': Read-only file system
rm: cannot remove `sess_1241a5500f08fd62b3c76c7f66036c59': Read-only file system
rm: cannot remove `sess_175741af7e0b6e2caf35bb7e2b6b0c96': Read-only file system
rm: cannot remove `sess_1c58d592b1138726dd8ec0926741e26b': Read-only file system
rm: cannot remove `sess_1ee9d56ee572a821259209e2371e8c87': Read-only file system
rm: cannot remove `sess_2709055978eb9fb049923a7973b0f51b': Read-only file system
rm: cannot remove `sess_29bfe57a6342a7b31c467303c33dbf5e': Read-only file system
rm: cannot remove `sess_377a84fe748941e68ea22ca10fc5c84e': Read-only file system
rm: cannot remove `sess_3ac734db138ef32ace37cc3471b2aaa3': Read-only file system
as i mention above that i cant do anything in the server, change permission, delete file, modify file and so on, all comes with the same error, Read-only
Normaly when your OS mounts your drive read-only it means your drive isnt looking good and might fail
as stated, this is an indication of a potential drive failure.
the OS, if it gets write errors, will tag the drive 'read only' so that data is protected.. often rebooting will run an FSCK which will resolve the issues and you'll be fine.
but definitely check for S.M.A.R.T errors and so some drive diagnostics, and replace the drive if this happens again.
also, as for tmp. I tend to prefer making /tmp a tmpfs volume rather than a directory off the root.
most definitely /tmp shouldn't be just a folder on your root partition, if it gets full, then it could cause you many problems for your OS..
potentially, root can be on your user/home direcotry partition.
many just make /tmp it's own partition.
I prefer the tmpfs approach.. if I want, I can make an additional partition, but instead of mounting it as /tmp, mount it as additional swap, and use tmpfs.
the os will automagically use extra unneded memory for tmp files and will swap them onto disk as needed.
since most of your tmp files are small short-lived files (or files that are accessed quickly, but oftern---like your session files), this will speed things up significantly.
especially if you're using mod_gzip, you'll notice a lot of _?????.wrk files in /tmp, if it can create these into memory, sever them out to the world, and dispose of them, it uses a minimal amoun of ram, and pages are served noticeably faster.
It's a /usr/tmpDSK (see OP's OP) which can become corrupt fairly easily. Best bet is to stop any processes that have files open on /tmp which you can check with:
lsof /tmp
Then umount /tmp and /var/tmp:
umount -l /tmp
umount -l /var/tmp
Then remove the corrupt partition file:
rm -fv /usr/tmpDSK
Then create a nice new one:
/scripts/securetmp
Jonathan Michaelson
Need your cPanel servers secured and tuned?
cPanel Server Configuration, Security, Recovery and Antivirus/AntiSpam Services
Developers of the most effective (and free) Firewall & Security Solution for cPanel Servers - csf
http://www.configserver.com
This is getting annoying. I've never had a problem with this until the release of CP11. Even though I do manual updates from CP, my tmp dir started filling up nightly even with 512K dir. When if fills up I start getting high 5 min CPU emails and spamd failures.
I did find this email:
Time: Wed May 2 23:13:40 2007
The following list of files have FAILED the md5sum comparision test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:
/usr/bin/sa-learn: FAILED
/usr/bin/sa-update: FAILED
/usr/bin/spamassassin: FAILED
/usr/bin/spamc: FAILED
/usr/bin/spamd: FAILED
/usr/sbin/antirelayd: FAILED
/usr/sbin/exim: FAILED
/usr/sbin/exim_dbmbuild: FAILED
/usr/sbin/exim_dumpdb: FAILED
/usr/sbin/exim_fixdb: FAILED
/usr/sbin/exim_lock: FAILED
/usr/sbin/eximstats: FAILED
/usr/sbin/exim_tidydb: FAILED
/usr/sbin/exiqsumm: FAILED
/usr/sbin/runq: FAILED
/usr/sbin/sendmail: FAILED
Anyone got a clue whats causing this?
Thanks,
Ron...
Last edited by NetBlaster; 05-06-2007 at 10:26 AM.
Looks like upgrades to me. Whats the tmp filling with?
Exim session file mostly
My server does auto package updates but the last upcp was the day before and with these results:
Exim (maildir) Setup Script Version 20.0
Fetching version information from http://updates.cpanel.net/eximinstall/version (CURRENT)....Fetching http://updates.cpanel.net/eximinstall/version (0)....@69.72.164.152......connected......receiving...100%......Done
Done
This is the exim 4.63 installer release number 1 for platform centos 4.4
exim is up to date. Use eximup --force to force a reinstall
Doesn't this mean it did not get updated?
Ron...
Last edited by NetBlaster; 05-06-2007 at 10:42 AM.
This looks like an email from "rkhunter"
it's not necessarily bad.
rkhunter is great, but.. it's not always kept as up to date as one would hope.
cpanel keeps your OS on the most current level (via yum updates), check your log for yum/rpm updates and you'll probably notice updates for all the packages listed.
rkhunter fetches it's checksum database, and if it doesn't have a checksum for the newest version (they're sometimes days or weeks behind), then it will report a checksum failure.
more importantly is to make sure that the versions installed match what's packaged in the RPM.
It's not from rkhunter even though I using that as well. It came from lfd.
lfd: System Integrity checking detected a modified system file
I looked at yum and the only recent package update is:
May 04 22:44:28 Installed: libxml2-devel.i386 2.6.16-6
My problem started on the 2nd of May. I noticed I have three high CPU processes constantly at about 15% each: cpbandwd, syslogd and kjournald. If I disable and spamd it goes away. I can reinable spamd and it runs fine for a while and then back to the high CPU emails like this:
lfd: High 5 minute load average alert - 6.07
Code:Time: Sun May 6 21:15:42 2007 1 Min Load Avg: 12.15 5 Min Load Avg: 6.07 15 Min Load Avg: 3.38 Running/Total Processes: 6/185 Output from ps: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 2964 552 ? S May05 0:11 init [3] root 2 0.0 0.0 0 0 ? S May05 0:01 [migration/0] root 3 0.0 0.0 0 0 ? SN May05 0:00 [ksoftirqd/0] root 4 0.0 0.0 0 0 ? S May05 0:01 [migration/1] root 5 0.0 0.0 0 0 ? SN May05 0:00 [ksoftirqd/1] root 6 0.0 0.0 0 0 ? S< May05 0:06 [events/0] root 8 0.0 0.0 0 0 ? S< May05 0:00 \_ [khelper] root 9 0.0 0.0 0 0 ? S< May05 0:00 \_ [kacpid] root 20 0.0 0.0 0 0 ? S< May05 0:21 \_ [kblockd/0] root 21 0.0 0.0 0 0 ? S< May05 0:15 \_ [kblockd/1] root 42 0.0 0.0 0 0 ? S< May05 0:00 \_ [aio/0] root 43 0.0 0.0 0 0 ? S< May05 0:00 \_ [aio/1] root 1635 0.0 0.0 0 0 ? S< May05 0:00 \_ [kauditd] root 22549 0.0 0.0 0 0 ? S 09:44 0:00 \_ [pdflush] root 7 0.0 0.0 0 0 ? S< May05 0:02 [events/1] root 342 0.0 0.0 0 0 ? S< May05 0:00 \_ [kmirrord] root 26910 0.0 0.0 0 0 ? S May05 0:31 \_ [pdflush] root 22 0.0 0.0 0 0 ? S May05 0:00 [khubd] root 41 0.0 0.0 0 0 ? S May05 0:49 [kswapd0] root 189 0.0 0.0 0 0 ? S May05 0:00 [kseriod] root 315 0.0 0.0 0 0 ? S May05 0:00 [scsi_eh_0] root 354 4.2 0.0 0 0 ? R May05 114:24 [kjournald] root 1578 0.0 0.0 1976 452 ? S<s May05 0:00 udevd root 1698 0.0 0.0 0 0 ? S May05 0:00 [kjournald] root 2390 4.9 0.0 2464 552 ? Ds May05 133:40 syslogd -m 0 root 2394 0.0 0.0 2500 384 ? Ss May05 0:00 klogd -x root 2404 0.0 0.0 2692 300 ? Ss May05 2:31 irqbalance root 2413 0.0 0.0 2028 292 ? S May05 0:00 /usr/sbin/courierlogger -pid=/var/spool/authdaemon/pid -facility=mail -start /usr/libexec/courier-authlib/authdaemond root 2414 0.0 0.0 2744 612 ? S May05 0:00 \_ /usr/libexec/courier-authlib/authdaemond root 2420 0.0 0.0 2744 360 ? S May05 0:00 \_ /usr/libexec/courier-authlib/authdaemond root 7445 0.0 0.1 7304 3892 ? S May05 0:03 | \_ /etc/authlib/authProg root 2421 0.0 0.0 2744 360 ? S May05 0:00 \_ /usr/libexec/courier-authlib/authdaemond root 10779 0.0 0.1 7304 3892 ? S May05 0:02 | \_ /etc/authlib/authProg root 2422 0.0 0.0 2744 360 ? S May05 0:00 \_ /usr/libexec/courier-authlib/authdaemond root 5658 0.0 0.1 7304 3896 ? S May05 0:03 | \_ /etc/authlib/authProg root 2423 0.0 0.0 2744 360 ? S May05 0:00 \_ /usr/libexec/courier-authlib/authdaemond root 5326 0.0 0.1 7304 3896 ? S May05 0:04 | \_ /etc/authlib/authProg root 2424 0.0 0.0 2744 360 ? S May05 0:00 \_ /usr/libexec/courier-authlib/authdaemond root 3813 0.0 0.1 7304 3892 ? S May05 0:03 \_ /etc/authlib/authProg root 2475 0.0 0.0 0 0 ? S May05 0:12 [vmmemctl] root 2490 0.0 0.0 1948 916 ? Ss May05 1:56 /usr/sbin/vmware-guestd --background /var/run/vmware-guestd.pid root 2695 0.0 0.0 2788 304 ? Ss May05 0:00 /var/dcc/libexec/dccifd -tCMN,5, -llog -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID root 2696 0.0 0.5 61880 11420 ? Sl May05 1:11 \_ /var/dcc/libexec/dccifd -tCMN,5, -llog -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID root 2705 0.0 0.0 1944 440 ? Ss May05 0:00 /usr/sbin/acpid root 2771 0.0 0.0 5316 1036 ? Ss May05 0:00 /usr/sbin/sshd root 21383 0.0 0.1 8260 2340 ? Ss 09:30 0:41 \_ sshd: root@pts/0 root 21410 0.0 0.0 5284 1452 pts/0 Ss+ 09:30 0:01 | \_ -bash root 18225 0.4 0.1 8572 2320 ? Ss 20:33 0:12 \_ sshd: root@pts/1 root 18228 0.0 0.0 5204 1440 pts/1 Ss 20:34 0:00 \_ -bash root 18649 1.9 0.0 3172 1004 pts/1 S+ 20:36 0:45 \_ top root 2784 0.0 0.0 3340 756 ? Ss May05 0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid root 2817 0.0 0.0 2576 292 ? S May05 0:00 /usr/sbin/courierlogger -pid=/var/run/imapd.pid -start -name=imapd /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=30 -nodnslookup -noidentlookup 143 /usr/lib/courier-imap/sbin/imaplogin /usr/lib/courier-imap/bin/imapd Maildir root 2818 0.0 0.0 2800 500 ? S May05 0:01 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=30 -nodnslookup -noidentlookup 143 /usr/lib/courier-imap/sbin/imaplogin /usr/lib/courier-imap/bin/imapd Maildir root 2824 0.0 0.0 2584 212 ? S May05 0:00 /usr/sbin/courierlogger -pid=/var/run/imapd-ssl.pid -start -name=imapd-ssl /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=30 -nodnslookup -noidentlookup 993 /usr/lib/courier-imap/bin/couriertls -server -tcpd /usr/lib/courier-imap/sbin/imaplogin /usr/lib/courier-imap/bin/imapd Maildir root 2825 0.0 0.0 2224 476 ? S May05 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=30 -nodnslookup -noidentlookup 993 /usr/lib/courier-imap/bin/couriertls -server -tcpd /usr/lib/courier-imap/sbin/imaplogin /usr/lib/courier-imap/bin/imapd Maildir root 2831 0.0 0.0 2568 292 ? S May05 0:03 /usr/sbin/courierlogger -pid=/var/run/pop3d.pid -start -name=pop3d /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=30 -nodnslookup -noidentlookup 110 /usr/lib/courier-imap/sbin/pop3login /usr/lib/courier-imap/bin/pop3d Maildir root 2832 0.0 0.0 2980 500 ? S May05 0:06 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=30 -nodnslookup -noidentlookup 110 /usr/lib/courier-imap/sbin/pop3login /usr/lib/courier-imap/bin/pop3d Maildir root 2840 0.0 0.0 3192 212 ? S May05 0:00 /usr/sbin/courierlogger -pid=/var/run/pop3d-ssl.pid -start -name=pop3d-ssl /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=30 -nodnslookup -noidentlookup 995 /usr/lib/courier-imap/bin/couriertls -server -tcpd /usr/lib/courier-imap/sbin/pop3login /usr/lib/courier-imap/bin/pop3d Maildir root 2842 0.0 0.0 2644 476 ? S May05 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=40 -maxperip=30 -nodnslookup -noidentlookup 995 /usr/lib/courier-imap/bin/couriertls -server -tcpd /usr/lib/courier-imap/sbin/pop3login /usr/lib/courier-imap/bin/pop3d Maildir root 3510 0.0 0.3 19124 8208 ? Ss May05 0:30 /usr/local/apache/bin/httpd -DSSL
This is the rest...
Code:nobody 3598 0.1 1.0 32988 22304 ? S May05 5:14 \_ /usr/local/apache/bin/httpd -DSSL nobody 3599 0.1 0.8 28020 17352 ? S May05 5:00 \_ /usr/local/apache/bin/httpd -DSSL nobody 3601 0.1 1.0 32936 22192 ? S May05 5:15 \_ /usr/local/apache/bin/httpd -DSSL nobody 3602 0.1 0.8 27812 17144 ? S May05 4:39 \_ /usr/local/apache/bin/httpd -DSSL nobody 3604 0.1 1.0 31984 21272 ? S May05 5:02 \_ /usr/local/apache/bin/httpd -DSSL nobody 3613 0.1 0.7 26972 16132 ? S May05 5:00 \_ /usr/local/apache/bin/httpd -DSSL nobody 4810 0.1 0.8 28292 17628 ? S May05 5:13 \_ /usr/local/apache/bin/httpd -DSSL nobody 4861 0.1 0.8 27576 16712 ? S May05 4:57 \_ /usr/local/apache/bin/httpd -DSSL nobody 5782 0.1 0.8 27916 17212 ? S May05 4:51 \_ /usr/local/apache/bin/httpd -DSSL nobody 5828 0.1 0.8 28332 17660 ? S May05 4:54 \_ /usr/local/apache/bin/httpd -DSSL root 3519 0.0 0.0 5512 1000 ? Ss May05 0:14 crond root 23565 0.1 0.0 6092 1164 ? S 21:15 0:00 \_ crond munin 23567 0.4 0.0 2980 868 ? Ss 21:15 0:00 \_ /bin/sh /usr/bin/munin-cron munin 23571 2.2 0.2 7348 4780 ? S 21:15 0:00 \_ /usr/bin/perl -w /usr/share/munin/munin-update munin 23612 1.5 0.2 7392 4704 ? S 21:15 0:00 \_ /usr/share/munin/munin-update [halo.petet.net] root 3545 0.0 0.2 9324 4320 ? Ss May05 0:46 /usr/sbin/munin-node root 23613 4.4 0.1 9324 3800 ? S 21:15 0:00 \_ /usr/sbin/munin-node nobody 23736 19.0 0.0 4924 992 ? Rs 21:15 0:00 \_ /bin/sh /etc/munin/plugins/entropy root 3748 0.0 0.0 7548 1140 ? Ss May05 0:02 pure-ftpd (SERVER) root 3752 0.0 0.0 6788 688 ? S May05 0:00 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/sbin/pureauth root 3823 0.0 0.3 15040 8284 ? S May05 0:00 /usr/bin/perl /usr/local/cpanel/cpdavd --start root 3884 6.1 0.1 7248 3772 ? D May05 165:39 cpbandwd root 3887 0.0 0.3 11208 6968 ? SN May05 2:18 cpanellogd - sleeping for logs mailman 3930 0.0 0.2 10628 4992 ? Ss May05 0:00 /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/mailmanctl -s start mailman 3934 0.0 0.3 11116 6704 ? S May05 1:37 \_ /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s mailman 3935 0.0 0.3 11932 6712 ? S May05 1:50 \_ /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:1 -s mailman 3937 0.0 0.3 11236 6640 ? S May05 1:40 \_ /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s mailman 3938 0.0 0.3 11368 6704 ? S May05 1:41 \_ /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:1 -s mailman 3939 0.0 0.3 11104 6656 ? S May05 1:41 \_ /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s mailman 3942 0.0 0.3 10140 6700 ? S May05 1:49 \_ /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:1 -s mailman 3943 0.0 0.3 10884 6696 ? S May05 1:43 \_ /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s mailman 3944 0.0 0.3 11748 6628 ? S May05 0:01 \_ /usr/local/bin/python2.4 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s dbus 3949 0.0 0.0 13412 956 ? Ssl May05 0:00 dbus-daemon-1 --system root 3961 0.3 0.1 6092 3496 ? Ss May05 10:26 hald root 3987 0.0 0.0 1480 392 ? Ss May05 0:00 /usr/sbin/portsentry -tcp root 4124 0.2 0.0 0 0 ? S< May05 7:23 [loop0] root 4126 0.2 0.0 0 0 ? S May05 6:12 [kjournald] root 4148 0.0 0.0 5404 1240 ? S May05 0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-file=/var/lib/mysql/halo.petet.net.pid mysql 4183 0.6 1.4 117204 30280 ? Sl May05 16:49 \_ /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/halo.petet.net.pid --skip-external-locking root 4211 0.0 0.0 3220 412 tty1 Ss+ May05 0:00 /sbin/mingetty tty1 root 4212 0.0 0.0 1452 408 tty2 Ss+ May05 0:00 /sbin/mingetty tty2 root 4213 0.0 0.0 2816 412 tty3 Ss+ May05 0:00 /sbin/mingetty tty3 root 4214 0.0 0.0 3296 408 tty4 Ss+ May05 0:00 /sbin/mingetty tty4 root 4216 0.0 0.0 2224 408 tty5 Ss+ May05 0:00 /sbin/mingetty tty5 root 4217 0.0 0.0 2748 412 tty6 Ss+ May05 0:00 /sbin/mingetty tty6 mailnull 5512 0.0 0.1 9656 3736 ? S May05 0:37 eximstats root 26935 0.5 0.0 0 0 ? S< May05 11:58 [loop1] root 19791 0.0 0.4 20200 9936 ? S May05 0:13 cpsrvd - waiting for connections named 30775 0.4 0.3 52024 6864 ? Ssl 00:23 5:14 /usr/sbin/named -u named root 22561 0.0 0.0 0 0 ? S< 09:44 0:04 [loop2] root 18496 0.2 0.0 0 0 ? S< 20:35 0:05 [loop3] root 18497 0.0 0.0 0 0 ? S 20:35 0:01 [kjournald] root 19751 0.5 0.2 10900 5512 ? S 20:42 0:11 lfd - sleeping root 23737 5.0 0.2 10900 5260 ? S 21:15 0:00 \_ lfd - (child) checking load... root 23738 13.0 0.0 3936 832 ? R 21:15 0:00 \_ /bin/ps axuf root 21026 0.0 0.2 10128 4816 ? S 20:53 0:00 chkservd root 22567 3.1 1.2 52044 25984 ? Ssl 21:04 0:20 /usr/sbin/clamd mailnull 22573 0.0 0.0 8168 904 ? Ss 21:04 0:00 /usr/sbin/exim -bd -q5m mailnull 23068 0.0 0.1 9252 3292 ? S 21:09 0:00 \_ /usr/sbin/exim -bd -q5m mailnull 23441 0.1 0.1 9232 3348 ? S 21:11 0:00 \_ /usr/sbin/exim -bd -q5m mailnull 23614 0.6 0.0 0 0 ? Z 21:15 0:00 \_ [exim] <defunct> mailnull 22577 0.0 0.0 8396 852 ? Ss 21:04 0:00 /usr/sbin/exim -tls-on-connect -bd -oX 465 root 22734 2.4 1.8 41608 38992 ? Ss 21:05 0:15 /usr/bin/spamd -d --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid --max-children=20 mailnull 22936 11.6 2.1 46364 43724 ? S 21:05 1:09 \_ spamd child root 22937 11.6 2.0 44956 42400 ? S 21:05 1:09 \_ spamd child root 23511 3.4 1.8 41940 39292 ? S 21:14 0:02 \_ spamd child mailnull 23512 3.9 1.9 42764 39908 ? S 21:14 0:02 \_ spamd child mailnull 23514 3.9 1.9 42892 39956 ? S 21:14 0:02 \_ spamd child mailnull 23516 4.3 1.8 42132 39280 ? S 21:14 0:03 \_ spamd child mailnull 23521 3.7 1.9 42856 39912 ? S 21:14 0:02 \_ spamd child mailnull 23525 4.5 1.9 42764 39912 ? S 21:14 0:02 \_ spamd child mailnull 23527 4.8 1.8 42132 39272 ? R 21:14 0:03 \_ spamd child mailnull 23531 4.7 1.9 42820 39920 ? S 21:14 0:02 \_ spamd child root 22812 0.8 0.0 3556 1004 ? S 21:05 0:05 antirelayd root 23549 0.7 0.1 10204 3900 ? S 21:14 0:00 /usr/sbin/exim -Mc 1HkrlV-00066E-Ut mailnull 23557 0.1 0.1 10204 2272 ? S 21:14 0:00 \_ /usr/sbin/exim -Mc 1HkrlV-00066E-Ut Output from vmstat: procs -----------memory---------- ---swap-- -----io---- --system-- ----cpu---- r b swpd free buff cache si so bi bo in cs us sy id wa 2 0 160 189244 53100 1257820 0 0 81 1011 127 17 15 18 63 5
The fix to remove session files is posted above. LFD needed restarted after an update, IIRC.