I have an old Redhat box that started doing this a while back. After a lot of hair pulling, I finally figured out that the problem was related to spam floods, but seemed to be caused by the syslog daemon. I shut down syslogd for a few days, and the problem went away completely. After those few days, I turned syslogd back on, but configured it to log to a separate syslog server (thinking that perhaps the problem was disk I/O related). However, the problem began happening again. I finally downgraded my syslogd to the previous version, and haven't seen any problems since.
Note that this is very likely not what is causing your problem. But it sometimes pays to consider the non-obvious. Your problem may be caused by something relatively unrelated to (but affected by) mail. Craig Quoting Matias Lopez Bergero <[EMAIL PROTECTED]>:
Hello! I was very happy using SpamAssassin at my email server (Xeon 2.8GHz, 1.5 GB memory, Dual Ultra SCSI HD 73.4GB in RAID 1, Linux 2.4.33) The last few weeks I have noted (angry users calling me by phone) that the server is really slow. The loadav goes from 1.5 to 12.5; normally is about 3.00. There are only 2500 email boxes at the server. The server is running: Sendmail, SpamAssassin 3.1.5 (using milter-spamc), ClamAV (using clamav-milter), Apache 1.3.x, SquirrelMail, pop3, etc. I have seeing some king of bursts of incoming emails (spam mostly), that it is producing a DoS effect. The server shows a table of ~1700 processes and about ~800 tcp sessions (sendmail and milter-spamc most) during this bursts. This seems to prevent other users from connecting to the server in order to use pop3 or smtp services. I have increased the child processes of spamd, but I was unsuccessfully to reduce this effect(I have seing in the logs a message about the need of increase the spamd childs). Also I tweak the sendmail.cf to easy the connection, but the problem persist. Looks to me that SpamAssassin is taking to long to process the incoming emails, and as result, it is slowing down the server, and finally causing the DoS. Can anyone help me with some ideas to solve this? or to see were exactly is the problem? Do I need to improve my hardware? Thanks. BR, Matias.
