Well I checked the queue and only 1 was in there. So I dunno what happened. Nothing in the logs show that there was an attack of some sort. It just ran the cronjob to update the blacklist, which has ran for 3 days now without problems until today, and then soon after I get messages from mysqld that it is out of memory. At the same time I have people reporting spam getting to their mailbox and in the headers SA was not assigning points, just question marks.
I would just feel better if I knew it was just the cronjob hanging or something to that nature. Robert -----Original Message----- From: PWG Support [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 21, 2004 9:27 AM To: [EMAIL PROTECTED] Subject: Re: SA Stopped Working I have the exact same problem. This happened yesterday too. We had to reboot the server and stop SA. The mail queue had 5000 emails (normally would have about 50). The large majority of the emails are bounced bounces and antivirus adminstrator alert messages. All form spammers sppofing the form address with domains on my server. Today we are running with SA stopped. If I knew how to let the bounced bounces (failure notices) and the antivurs messages skip the qmailscanner then I think it would reduce the load... ----- Original Message ----- From: "Robert Bartlett" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, July 21, 2004 12:03 PM Subject: SA Stopped Working > This morning I wake up to find my server extremely slow. After about 5 > minutes I was able to finally get to the command line on the box. I check > out the memory usage and it showed only 3 megs available. I checked the > processes and noticed spamd having multiple instances with it ran by nobody > and with the processing up to 99% with memory at 70%. Apparently whenever > this started SA stopped working because I have people telling me they got a > bunch of spam in their mailbox and when you look at the headers it has > question marks instead of points for the SA section. > > Now the weird part is nobody would never run spamd, only the qmailscanner. > Also I noticed it wasnt its usual line, instead of the normal spamd -h -m5 > then a couple of other flags, it was showing spamd -u > [EMAIL PROTECTED] > > When I tried restarting SA the same issue was happening, it required me to > stop it for a few minutes and then bring it back up. After that all is well. > Any idea what happened? Could this have been a hack? Anyway of preventing > this? > > Thanks > Robert > >
