The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Server load/spamd problem

Discussion in 'Database Discussions' started by TitanJeff, Nov 1, 2012.

  1. TitanJeff

    TitanJeff Member

    Joined:
    Jul 14, 2011
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Sorry for the long post but I'm hoping more info on this the better in diagnosing the issue.

    I've been having a problem the last month with my server, on a daily basis, having big server loads, filling memory and, eventually, shutting down. Here's an example of what I received today:


    IMPORTANT: Do not ignore this email.
    **** This is cPanel stats runner on xxx.net
    **** While processing the log files for user xxxxx, the cpu has been
    maxed out for more than a 6 hour period. ****The current load/uptime line on the server at the time of
    this email is
    **** 13:07:14 up 2 days, ****5:40, ****0 users, ****load average: 4.05, 2.52, 2.41
    **** You should check the server to see why the load is so high and take
    steps to lower the load. ****If you want stats to continue to run even with a high load; Edit
    /var/cpanel/cpanel.config and change extracpus to a number larger then 0 (run
    /usr/local/cpanel/startup afterwards to pickup the changes).

    ------

    When I go to WHM and check server status, I see high server loads and memory used almost at 100%.

    I do a graceful server reboot every day which fixes the problem until the next day.

    This has been the email the server has emailed me in past days when I don't do a reboot:

    Message 1:

    spamd failed @ Sat Oct 13 08:59:48 2012. A restart was attempted automagically.

    Service Check Method: ****[check command]

    Number of Restart Attempts: 1

    Cmd Service Check Raw Output: Spamd is not running
    Raw Output:


    Syslog Messages: Oct 13 08:24:14 c1093-kc01 spamd[8252]: prefork: child states:
    II
    Oct 13 08:27:43 c1093-kc01 spamd[8277]: spamd: connection from localhost
    [127.0.0.1] at port 36778
    Oct 13 08:27:43 c1093-kc01 spamd[8277]: spamd: setuid to xxxxx succeeded
    Oct 13 08:27:44 c1093-kc01 spamd[8277]: spamd: checking message
    <20121013132740.C63386E317A@core.xenforo.com> for xxxx:505
    Oct 13 08:27:50 c1093-kc01 spamd[8277]: spamd: clean message (-3.0/5.0) for
    jfuqua:505 in 7.2 seconds, 8289 bytes.
    Oct 13 08:27:50 c1093-kc01 spamd[8277]: spamd: result: . -3 -
    AWL,BAYES_00,HTML_MESSAGE,RP_MATCHES_RCVD,SPF_HELO_PASS,SPF_PASS
    scantime=7.2,size=8289,user=jfuqua,uid=505,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=36778,mid=<20121013132740.C63386E317A@core.xenforo.com>,bayes=0.000000,autolearn=ham,shortcircuit=no
    Oct 13 08:27:52 c1093-kc01 spamd[8252]: prefork: child states: BI
    Oct 13 08:27:55 c1093-kc01 spamd[8252]: spamd: handled cleanup of child pid
    [8277] due to SIGCHLD: exit 0
    Oct 13 08:27:55 c1093-kc01 spamd[8252]: spamd: server successfully spawned child
    process, pid 18795
    Oct 13 08:27:55 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:33:04 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 52844
    Oct 13 08:33:04 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:33:05 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:33:10 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 8.1 seconds, 834 bytes.
    Oct 13 08:33:10 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=8.1,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=52844,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:33:12 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:38:06 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 58757
    Oct 13 08:38:06 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:38:06 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:38:10 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 4.6 seconds, 834 bytes.
    Oct 13 08:38:10 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=4.6,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=58757,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:38:12 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:43:17 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 52365
    Oct 13 08:43:17 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:43:17 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:43:20 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 3.3 seconds, 834 bytes.
    Oct 13 08:43:20 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=3.3,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=52365,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:43:20 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 57054
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 0.2 seconds, 834 bytes.
    Oct 13 08:48:26 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=0.2,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=57054,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:48:26 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 08:54:26 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 47232
    Oct 13 08:54:26 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded
    Oct 13 08:54:26 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001
    Oct 13 08:54:28 c1093-kc01 spamd[8278]: spamd: identified spam (1000.0/5.0) for
    cpanel:32001 in 2.1 seconds, 834 bytes.
    Oct 13 08:54:28 c1093-kc01 spamd[8278]: spamd: result: Y 999 -
    GTUBE,NO_RECEIVED,NO_RELAYS
    scantime=2.1,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=47232,mid=<GTUBE1.1010101@example.net>,autolearn=no,shortcircuit=no
    Oct 13 08:54:28 c1093-kc01 spamd[8252]: prefork: child states: II
    Oct 13 09:00:22 c1093-kc01 spamd[8278]: spamd: connection from localhost
    [127.0.0.1] at port 40558
    Oct 13 09:00:42 c1093-kc01 spamd[8278]: spamd: setuid to cpanel succeeded


    =========

    Message 2:


    spamd failed @ Sat Oct 13 09:09:10 2012. A restart was attempted automagically.

    Service Check Method: ****[check command]

    Number of Restart Attempts: 2

    Cmd Service Check Raw Output: Spamd is not running
    Raw Output: Subject: Test spam mail (GTUBE)
    Message-ID: <GTUBE1.1010101@example.net>
    Date: Wed, 23 Jul 2003 23:30:00 +0200
    From: Sender <sender@example.net>
    To: Recipient <recipient@example.net>
    Precedence: junk
    MIME-Version: 1.0
    Content-Type: text/plain; charset=us-ascii
    Content-Transfer-Encoding: 7bit

    This is the GTUBE, the
    **** **** **** **** Generic
    **** **** **** **** Test for
    **** **** **** **** Unsolicited
    **** **** **** **** Bulk
    **** **** **** **** Email

    If your spam filter supports it, the GTUBE provides a test by which you
    can verify that the filter is installed correctly and is detecting incoming
    spam. You can send yourself a test mail containing the following string of
    characters (in upper case and with no white spaces and line breaks):

    XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

    You should send this test mail from an account outside of your network.




    Syslog Messages: Oct 13 08:27:52 c1093-kc01 spamd[8252]: prefork: child states:
    BI

    Oct 13 09:02:50 c1093-kc01 spamd[8278]: spamd: processing message
    <GTUBE1.1010101@example.net> for cpanel:32001


    My host isn't much help and my own experience is limited. Is there anything in WHM I can check to see the cause of this?

    Thanks.
     
  2. storminternet

    storminternet Well-Known Member

    Joined:
    Nov 2, 2011
    Messages:
    462
    Likes Received:
    0
    Trophy Points:
    16
    cPanel Access Level:
    Root Administrator
    Log output shows that spamd was not running on your server. Have you enabled spamd from WHM Main >> Service Configuration >> Service Manager. Check the exim logs at /var/log/exim_mainlog to find out the user sending bulk emails.
     
  3. arunsv84

    arunsv84 Well-Known Member

    Joined:
    Oct 20, 2008
    Messages:
    373
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    127.0.0.1
    cPanel Access Level:
    Root Administrator
    Also if spamd is consuming resources you can restrict the usage by installing "spamdconf" after logging to WHM >> Manage Plugins >> Select "Install and keep updated" in "spamdconf " >> Save. Once its completed, you should be able to configure the values under WHM >> Home >> Main >> Plugins.

    Cheers!!!
     
  4. TitanJeff

    TitanJeff Member

    Joined:
    Jul 14, 2011
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Thanks for your reply.

    spamd is on but I was unable to get to any logs. It gave me a 404.

    - - - Updated - - -

    Thanks!

    Any ideas on what the values should be? I Googled this and came up with 10 children and left the rest blank.
     
    #4 TitanJeff, Nov 3, 2012
    Last edited: Nov 3, 2012
Loading...

Share This Page