Exim failed, 5.6 gig maillog.1

[Man0warr]

At like 8:45pm Exim failed, then around 9 we got this e-mail:

IMPORTANT: Do not ignore this email.
This is cPanel stats runner on proton.einsteinsname02.net!
While processing the log files for user xxxxxx, the cpu has been
maxed out for more than a 6 hour period. The current load/uptime line on the server at the time of
this email is
21:17:54 up 93 days, 9:18, 0 users, load average: 2.59, 3.37, 3.01
You should check the server to see why the load is so high and take
steps to lower the load. If you want stats to continue to run even with a high load; Edit
/var/cpanel/cpanel.config and change extracpus to a number larger then 0 (run
/usr/local/cpanel/startup afterwards to pickup the changes).

I didn't think much of it at the time, as 2.6 load wasn't huge.

Around midnight we got some /var drive space warnings.

I couldn't figure out what was going wrong, so I went to check the maillogs. Maillog.1 was 5.6gigs! We rotate nightly, and keep up to 15 days. I tried to move maillog.1 out of /var to somewhere with more drive space, wouldn't let me.

All the time exim is down, the load was up to like 14 now, I couldn't get exim to restart. When I deleted maillog.1 I was able to restart exim and the load went down.

During this time, clients could still get e-mail but couldn't send, so I was getting alot of calls.

Everything seems to be back to normal now, but the maillogs and other logs had been rotating fine for months and I STILL don't know what caused this.

 

[celliott]

Have you got SMTP Tweak Enabled, or are you allowing "Nobody" to send mail?

 

[chirpy]

That's likely to be a problem with logrotate. Do you have your /tmp mounted noexec? If so, thne there's a know problem with logrotate that can break things. To workaround it you need to setup a TMPDIR for logrotate to avoid the problem:

You can do this by editing /etc/cron.daily/logrotate so that it looks like this:

#!/bin/sh

if [ ! -e "/logrotate_tmp" ]; then
	mkdir /logrotate_tmp
fi
export TMPDIR=/logrotate_tmp

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

 

[Man0warr]

Why would this happen all of a sudden though? It's been rotating fine since I set it up.

I don't think /tmp is set to noexec,

/dev/hda8/ on /tmp type ext3 (rw)

 

[chirpy]

Since you don't have to noexec option (from that mount output) what I mentioned shouldn't be the issue. However, the fact it was logging to maillog.1 does mean that logrotate failed for some reason. If you ever see that happening again, restart syslog