Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Server load/spamd problem

Discussion in 'Database Discussion' started by TitanJeff, Nov 1, 2012.

  1. TitanJeff

    TitanJeff Member

    Joined:
    Jul 14, 2011
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    51
    Sorry for the long post but I'm hoping more info on this the better in diagnosing the issue.

    I've been having a problem the last month with my server, on a daily basis, having big server loads, filling memory and, eventually, shutting down. Here's an example of what I received today:


    IMPORTANT: Do not ignore this email.
    **** This is cPanel stats runner on xxx.net
    **** While processing the log files for user xxxxx, the cpu has been
    maxed out for more than a 6 hour period. ****The current load/uptime line on the server at the time of
    this email is
    **** 13:07:14 up 2 days, ****5:40, ****0 users, ****load average: 4.05, 2.52, 2.41
    **** You should check the server to see why the load is so high and take
    steps to lower the load. ****If you want stats to continue to run even with a high load; Edit
    /var/cpanel/cpanel.config and change extracpus to a number larger then 0 (run
    /usr/local/cpanel/startup afterwards to pickup the changes).

    ------

    When I go to WHM and check server status, I see high server loads and memory used almost at 100%.

    I do a graceful server reboot every day which fixes the problem until the next day.

    This has been the email the server has emailed me in past days when I don't do a reboot:

    Message 1:

    spamd failed @ Sat Oct 13 08:59:48 2012. A restart was attempted automagically.

    Service Check Method: ****[check command]

    Number of Restart Attempts: 1

    Cmd Service Check Raw Output: Spamd is not running
    Raw Output:


    Syslog Messages: Oct 13 08:24:14 c1093-kc01 spamd[8252]: prefork: child states:
    II
    Oct 13 08:27:43 c1093-kc01 spamd[8277]: spamd: connection from localhost
    [127.0.0.1] at port 36778
    Oct 13 08:27:43 c1093-kc01 spamd[8277]: spamd: setuid to xxxxx succeeded
    Oct 13 08:27:44 c1093-kc01 spamd[8277]: spamd: checking message
    <20121013132740.C63386E317A@core.xenforo.com> for xxxx:505
    Oct 13 08:27:50 c1093-kc01 spamd[8277]: spamd: clean message (-3.0/5.0) for
    jfuqua:505 in 7.2 seconds, 8289 bytes.
    Oct 13 08:27:50 c1093-kc01 spamd[8277]: spamd: result: . -3 -
    AWL,BAYES_00,HTML_MESSAGE,RP_MATCHES_RCVD,SPF_HELO_PASS,SPF_PASS
    scantime=7.2,size=8289,user=jfuqua,uid=505,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=36778,mid=<20121013132740.C63386E317A@core.xenforo.com>,bayes=0.000000,autolearn=ham,shortcircuit=no
    Oct 13 08:27:52 c1093-kc01 spamd[8252]: prefork: child states: BI
    Oct 13 08:27:55 c1093-kc01 spamd[8252]: spamd: handled cleanup of child pid
    [8277] due to SIGCHLD: exit 0
    Oct 13 08:27:55 c1093-kc01 spamd[8252]: spamd: server successfully spawned child
    process, pid 18795
    Oct 13 08:27:55 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:33:04 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 52844
    Oct 13 08:33:04 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:33:05 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:33:10 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 8.1 seconds, 834 bytes.
    Oct 13 08:33:10 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=8.1,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=52844,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:33:12 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:38:06 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 58757
    Oct 13 08:38:06 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:38:06 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:38:10 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 4.6 seconds, 834 bytes.
    Oct 13 08:38:10 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=4.6,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=58757,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:38:12 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:43:17 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 52365
    Oct 13 08:43:17 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:43:17 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:43:20 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 3.3 seconds, 834 bytes.
    Oct 13 08:43:20 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=3.3,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=52365,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:43:20 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 57054
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 0.2 seconds, 834 bytes.
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=0.2,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=57054,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:48:26 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:54:26 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 47232
    Oct 13 08:54:26 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:54:26 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:54:28 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 2.1 seconds, 834 bytes.
    Oct 13 08:54:28 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=2.1,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=47232,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:54:28 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 09:00:22 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 40558
    Oct 13 09:00:42 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded


    =========

    Message 2:


    spamd failed @ Sat Oct 13 09:09:10 2012. A restart was attempted automagically.

    Service Check Method: ****[check command]

    Number of Restart Attempts: 2

    Cmd Service Check Raw Output: Spamd is not running
    Raw Output: Subject: Test spam mail (GTUBE)
    Message-ID: <GTUBE1.1010101@example.net>
    Date: Wed, 23 Jul 2003 23:30:00 +0200
    From: Sender <sender@example.net>
    To: Recipient <recipient@example.net>
    Precedence: junk
    MIME-Version: 1.0
    Content-Type: text/plain; charset=us-ascii
    Content-Transfer-Encoding: 7bit

    This is the GTUBE, the
    **** **** **** **** Generic
    **** **** **** **** Test for
    **** **** **** **** Unsolicited
    **** **** **** **** Bulk
    **** **** **** **** Email

    If your spam filter supports it, the GTUBE provides a test by which you
    can verify that the filter is installed correctly and is detecting incoming
    spam. You can send yourself a test mail containing the following string of
    characters (in upper case and with no white spaces and line breaks):

    XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

    You should send this test mail from an account outside of your network.




    Syslog Messages: Oct 13 08:27:52 c1093-kc01 spamd[8252]: prefork: child states:
    BI

    Oct 13 09:02:50 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001


    My host isn't much help and my own experience is limited. Is there anything in WHM I can check to see the cause of this?

    Thanks.
     
  2. storminternet

    storminternet Well-Known Member

    Joined:
    Nov 2, 2011
    Messages:
    460
    Likes Received:
    0
    Trophy Points:
    66
    cPanel Access Level:
    Root Administrator
    Log output shows that spamd was not running on your server. Have you enabled spamd from WHM Main >> Service Configuration >> Service Manager. Check the exim logs at /var/log/exim_mainlog to find out the user sending bulk emails.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. arunsv84

    arunsv84 Well-Known Member

    Joined:
    Oct 20, 2008
    Messages:
    373
    Likes Received:
    1
    Trophy Points:
    68
    Location:
    127.0.0.1
    cPanel Access Level:
    Root Administrator
    Also if spamd is consuming resources you can restrict the usage by installing "spamdconf" after logging to WHM >> Manage Plugins >> Select "Install and keep updated" in "spamdconf " >> Save. Once its completed, you should be able to configure the values under WHM >> Home >> Main >> Plugins.

    Cheers!!!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. TitanJeff

    TitanJeff Member

    Joined:
    Jul 14, 2011
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    51
    Thanks for your reply.

    spamd is on but I was unable to get to any logs. It gave me a 404.

    - - - Updated - - -

    Thanks!

    Any ideas on what the values should be? I Googled this and came up with 10 children and left the rest blank.
     
    #4 TitanJeff, Nov 3, 2012
    Last edited: Nov 3, 2012
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice