The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

spamd eating memory and cpu, load averages > 2

Discussion in 'General Discussion' started by heath, Apr 9, 2005.

  1. heath

    heath Member

    Joined:
    Jul 11, 2003
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    1
    On my server, spamd is constantly eating memory and CPU times, shooting my load average over 2. I've installed the dictionary attack blocker talked about here, but it still isn't helping. I only have about 4 small sites on my server so this shouldn't be happening. Here is a show of top:

    13:20:16 up 20 days, 14:02, 1 user, load average: 2.22, 2.11, 2.05
    105 processes: 100 sleeping, 2 running, 3 zombie, 0 stopped
    CPU states: 20.3% user 2.7% system 0.0% nice 0.0% iowait 76.8% idle
    Mem: 505716k av, 500260k used, 5456k free, 0k shrd, 2140k buff
    300836k actv, 65432k in_d, 10756k in_c
    Swap: 1052248k av, 526124k used, 526124k free 25244k cached

    PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
    26461 mailnull 15 0 528 256 180 S 99.9 0.0 1:17 0 exim
    12608 planproj 16 0 27204 19M 1416 S 7.9 3.9 1:14 0 spamd
    12300 planproj 16 0 27240 19M 1444 S 7.3 3.9 1:14 0 spamd
    28267 root 21 0 3680 3680 2664 S 1.9 0.7 0:00 0 exim
    28258 root 21 0 3684 3684 2664 S 1.7 0.7 0:00 0 exim
    12425 planproj 15 0 422M 241M 12 D 1.5 48.8 2:44 0 spamd


    Any ideas? This is really bad...
     
  2. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    The problem is probably that you are memory thrashing - that is you're server has basically run out of physical RAM and is continuously swapping memory pages to the swapfile and back. This is seems evident from your swapfile usage that you've quoted and from the spamd process that has consumed 241M of memory.

    When you are in top, try pressing M (that's shift-m) to sort by memory usage. That should give you an idea of what's eating it all up, though it's quite clear that is is SpamAssassin.

    You might want to disable SpamAssassin which consumes considerable memory by unchecking WHM > Service Manager > spamd and WHM > Tweak Settings > SpamAssassin and then investigating what is causing it to bloom like that.
     
    #2 chirpy, Apr 9, 2005
    Last edited: Apr 9, 2005
  3. DavidR

    DavidR Well-Known Member

    Joined:
    Feb 25, 2003
    Messages:
    177
    Likes Received:
    0
    Trophy Points:
    16
    I was running quite smoothly until about 3/29, when spamd began eating memory more and more. My server started running out of memory and crashing. I'm still not sure why as the email loads and all other activity look to be about the same. I "think" it corresponds to a cPanel upgrade (Release) but I haven't been able to track that down yet. At someone elses suggestion, I installed the spamd startup config addon and set Maximum Children to 2, leaving the other options blank. After it restarted exim, the loads went down to almost normal again. Give it a try and see if it helps.

    David
     
  4. heath

    heath Member

    Joined:
    Jul 11, 2003
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    1
    Hi,

    Where did you get this startup config editor for spamd?

    Also, is there anything else I can do besides removing spamassassin? I keep getting dictionary attacks it looks like, rather than a lot of spam emails. Would removing spamassassin solve this issue?
     
  5. heath

    heath Member

    Joined:
    Jul 11, 2003
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    1
    I think I figured out the problem. All unrouted email for one of my domains was getting sent to a default address, so dictionary attacks were all looked at by the spam daemon. Once I blackhole'd the default address, the spam daemon no longer looks at those emails.... hopefully my load avg will go down now.
     
  6. DavidR

    DavidR Well-Known Member

    Joined:
    Feb 25, 2003
    Messages:
    177
    Likes Received:
    0
    Trophy Points:
    16
    Go to WHM, it's in Cpanel > Addon Scripts with all the other addons from cpanel. It did so much to improve my situation, I would suggest that anyone using SA install it and read up on the settings at spamassassin.org. In my case, just the one setting above did the trick. Good luck.

    David
     
  7. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Be sure to use :fail: and not :blackhole: you can also find a dictionary attack ACL to further reduce the harm that they do here:
    http://www.configserver.com/free/eximdeny.html
     
  8. AlexAT

    AlexAT Well-Known Member
    PartnerNOC

    Joined:
    May 23, 2003
    Messages:
    203
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Ukraine
    cPanel Access Level:
    Root Administrator

    I also install this module and when I log in as reseller to its WHM I was suprised by seeing that this module accessible from reseller WHM and reseller can change values there.
     
  9. anup123

    anup123 Well-Known Member

    Joined:
    Mar 29, 2004
    Messages:
    897
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    This Planet
    http://forums.cpanel.net/showthread.php?t=35041&page=2&pp=15&highlight=spamd

    No response
    bugzilla ..... don't see any use if one has to post it there come back to forum and then restart it again asking forum visitors to visit bugzilla entry... vote for it. Utterly painful.
     
  10. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16

    How do you use this startup script editor? I've installed it, but can't find out how to use it. I've searched the forums and come up empty? Is there documentation anywhere for this one?
     
  11. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16
    can anyone tell me how to use this script?
     
  12. Spiral

    Spiral BANNED

    Joined:
    Jun 24, 2005
    Messages:
    2,023
    Likes Received:
    7
    Trophy Points:
    0
    I'd check the Bayes and Autowhitelist databases for each site and make
    sure that you don't have one or more that have grown massively huge.

    Every so often, you need to truncate and reset those files else they get
    big and slow down your Spamassassin scans as well as eat a lot of memory.
     
  13. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16
    Shouldn't this be something that Spamassasin maintains itself? What is the beset way to truncate those files. For example, I have one site that is 45mb. I don't know if that is excessive in size or not. But how do I truncate that file?

    Whould there be a way to write a script to automatically do this?
     
  14. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16
    Spiral,

    Whats the best way to "truncate" and reset those files?
     
  15. ispro

    ispro Well-Known Member

    Joined:
    Apr 8, 2004
    Messages:
    628
    Likes Received:
    1
    Trophy Points:
    18
    Use the following code:
    We are using this code and it works well. It remove the Bayes databases if the main dictionary file over 10 Mb.
     
  16. DavidR

    DavidR Well-Known Member

    Joined:
    Feb 25, 2003
    Messages:
    177
    Likes Received:
    0
    Trophy Points:
    16
    Do you run this as a bash script through cron?

    edit: I just tried running this as a bash script and got the following error:

    "Missing $ on loop variable at /scripts/trim_bay line 5"
    which is "do PP=`echo $P|sed s/bayes_toks//`;".
     
    #16 DavidR, Aug 15, 2005
    Last edited: Aug 15, 2005
Loading...

Share This Page