spamd eating memory and cpu, load averages > 2

heath

Member
Jul 11, 2003
18
0
151
On my server, spamd is constantly eating memory and CPU times, shooting my load average over 2. I've installed the dictionary attack blocker talked about here, but it still isn't helping. I only have about 4 small sites on my server so this shouldn't be happening. Here is a show of top:

13:20:16 up 20 days, 14:02, 1 user, load average: 2.22, 2.11, 2.05
105 processes: 100 sleeping, 2 running, 3 zombie, 0 stopped
CPU states: 20.3% user 2.7% system 0.0% nice 0.0% iowait 76.8% idle
Mem: 505716k av, 500260k used, 5456k free, 0k shrd, 2140k buff
300836k actv, 65432k in_d, 10756k in_c
Swap: 1052248k av, 526124k used, 526124k free 25244k cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
26461 mailnull 15 0 528 256 180 S 99.9 0.0 1:17 0 exim
12608 planproj 16 0 27204 19M 1416 S 7.9 3.9 1:14 0 spamd
12300 planproj 16 0 27240 19M 1444 S 7.3 3.9 1:14 0 spamd
28267 root 21 0 3680 3680 2664 S 1.9 0.7 0:00 0 exim
28258 root 21 0 3684 3684 2664 S 1.7 0.7 0:00 0 exim
12425 planproj 15 0 422M 241M 12 D 1.5 48.8 2:44 0 spamd


Any ideas? This is really bad...
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,453
31
473
Go on, have a guess
The problem is probably that you are memory thrashing - that is you're server has basically run out of physical RAM and is continuously swapping memory pages to the swapfile and back. This is seems evident from your swapfile usage that you've quoted and from the spamd process that has consumed 241M of memory.

When you are in top, try pressing M (that's shift-m) to sort by memory usage. That should give you an idea of what's eating it all up, though it's quite clear that is is SpamAssassin.

You might want to disable SpamAssassin which consumes considerable memory by unchecking WHM > Service Manager > spamd and WHM > Tweak Settings > SpamAssassin and then investigating what is causing it to bloom like that.
 
Last edited:

DavidR

Well-Known Member
Feb 25, 2003
177
0
166
I was running quite smoothly until about 3/29, when spamd began eating memory more and more. My server started running out of memory and crashing. I'm still not sure why as the email loads and all other activity look to be about the same. I "think" it corresponds to a cPanel upgrade (Release) but I haven't been able to track that down yet. At someone elses suggestion, I installed the spamd startup config addon and set Maximum Children to 2, leaving the other options blank. After it restarted exim, the loads went down to almost normal again. Give it a try and see if it helps.

David
 

heath

Member
Jul 11, 2003
18
0
151
Hi,

Where did you get this startup config editor for spamd?

Also, is there anything else I can do besides removing spamassassin? I keep getting dictionary attacks it looks like, rather than a lot of spam emails. Would removing spamassassin solve this issue?
 

heath

Member
Jul 11, 2003
18
0
151
I think I figured out the problem. All unrouted email for one of my domains was getting sent to a default address, so dictionary attacks were all looked at by the spam daemon. Once I blackhole'd the default address, the spam daemon no longer looks at those emails.... hopefully my load avg will go down now.
 

DavidR

Well-Known Member
Feb 25, 2003
177
0
166
heath said:
Hi,

Where did you get this startup config editor for spamd?

Also, is there anything else I can do besides removing spamassassin? I keep getting dictionary attacks it looks like, rather than a lot of spam emails. Would removing spamassassin solve this issue?
Go to WHM, it's in Cpanel > Addon Scripts with all the other addons from cpanel. It did so much to improve my situation, I would suggest that anyone using SA install it and read up on the settings at spamassassin.org. In my case, just the one setting above did the trick. Good luck.

David
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,453
31
473
Go on, have a guess
heath said:
I think I figured out the problem. All unrouted email for one of my domains was getting sent to a default address, so dictionary attacks were all looked at by the spam daemon. Once I blackhole'd the default address, the spam daemon no longer looks at those emails.... hopefully my load avg will go down now.
Be sure to use :fail: and not :blackhole: you can also find a dictionary attack ACL to further reduce the harm that they do here:
http://www.configserver.com/free/eximdeny.html
 

AlexAT

Well-Known Member
PartnerNOC
May 23, 2003
202
0
166
Ukraine
cPanel Access Level
Root Administrator
DavidR said:
At someone elses suggestion, I installed the spamd startup config addon and set Maximum Children to 2, leaving the other options blank. After it restarted exim, the loads went down to almost normal again. Give it a try and see if it helps.
David

I also install this module and when I log in as reseller to its WHM I was suprised by seeing that this module accessible from reseller WHM and reseller can change values there.
 

anup123

Well-Known Member
Mar 29, 2004
889
1
168
This Planet
AlexAT said:
I also install this module and when I log in as reseller to its WHM I was suprised by seeing that this module accessible from reseller WHM and reseller can change values there.
http://forums.cpanel.net/showthread.php?t=35041&page=2&pp=15&highlight=spamd

No response
bugzilla ..... don't see any use if one has to post it there come back to forum and then restart it again asking forum visitors to visit bugzilla entry... vote for it. Utterly painful.
 

noimad1

Well-Known Member
Mar 27, 2003
626
0
166
DavidR said:
Go to WHM, it's in Cpanel > Addon Scripts with all the other addons from cpanel. It did so much to improve my situation, I would suggest that anyone using SA install it and read up on the settings at spamassassin.org. In my case, just the one setting above did the trick. Good luck.

David

How do you use this startup script editor? I've installed it, but can't find out how to use it. I've searched the forums and come up empty? Is there documentation anywhere for this one?
 

noimad1

Well-Known Member
Mar 27, 2003
626
0
166
noimad1 said:
How do you use this startup script editor? I've installed it, but can't find out how to use it. I've searched the forums and come up empty? Is there documentation anywhere for this one?
can anyone tell me how to use this script?
 

Spiral

BANNED
Jun 24, 2005
2,018
8
193
I'd check the Bayes and Autowhitelist databases for each site and make
sure that you don't have one or more that have grown massively huge.

Every so often, you need to truncate and reset those files else they get
big and slow down your Spamassassin scans as well as eat a lot of memory.
 

noimad1

Well-Known Member
Mar 27, 2003
626
0
166
Spiral said:
I'd check the Bayes and Autowhitelist databases for each site and make
sure that you don't have one or more that have grown massively huge.

Every so often, you need to truncate and reset those files else they get
big and slow down your Spamassassin scans as well as eat a lot of memory.
Shouldn't this be something that Spamassasin maintains itself? What is the beset way to truncate those files. For example, I have one site that is 45mb. I don't know if that is excessive in size or not. But how do I truncate that file?

Whould there be a way to write a script to automatically do this?
 

ispro

Well-Known Member
Verifed Vendor
Apr 8, 2004
628
2
168
Use the following code:
for P in `find /home*/*/.spamassassin/ -name "bayes_toks" -size +10240k | xargs -i echo {}`; do PP=`echo $P|sed s/bayes_toks//`; cat /dev/null > $PP"bayes_journal"; cat /dev/null > $PP"bayes_seen"; cat /dev/null > $PP"bayes_toks"; done;
We are using this code and it works well. It remove the Bayes databases if the main dictionary file over 10 Mb.
 

DavidR

Well-Known Member
Feb 25, 2003
177
0
166
Do you run this as a bash script through cron?

edit: I just tried running this as a bash script and got the following error:

"Missing $ on loop variable at /scripts/trim_bay line 5"
which is "do PP=`echo $P|sed s/bayes_toks//`;".
 
Last edited: