Exim Sends A Lot Of Zombie Process!

[bsasninja]

I having this problem, not all time but sometimes it does spikes to the server.

When this problem more than 30 zombie process are shown in top, when I run ps aux
I see a lot of mailnull exim <defunct> process.

The queue is fine, no one sending out spam. I have Configserver´s dictionary attack, spamassasin and other rules in exim.conf for acl control.

Could it be a ddos or lot of spam coming to the server at the same time?¿ Is there a way to avoid this from happening?

Thanks

 

[bsasninja]

I could see that there is a spammer bombing a mail account of one of my customers, it seems with a open relay program.

All the emails are the same, but the ip are different so I cant ban it. There is a rule at antivirus.exim that is deleting all the emails with that subject. But the server process each mail and delete them so I dont want do this.


Any solution?