Hi group,
After a couple of days experimenting and searching the internet +
reading the FAQ I decided to try my luck here :)
Since last week one of my mailservers is running out of memory on a
regular basis because of the memory usage of spamd. At those times one
spamd process is using ~ 75% of the total system memory (according to
top / ps aux). The kernel is complaining that there is not enough memory
and the OOM-killer comes in action to randomly shoot processes.
The strange thing is: there are no changes made to the server. No
software updates and no configuration changes.
The system is a AMD Athlong 1Ghz box with 320MB of RAM and 512MB swap
space running Debian GNU/Linux 3.0 (Sarge) with kernel 2.6.8-3-686
(Debian stock kernel).
Spamassassin (3.0.3 with perl 5.8.4) is used as a daemon in combination
with Exim4-daemon-heavy (4.50).
Spamd is started with the following options:
--no-create-prefs --max-children 3 --helper-home-dir -d
--pidfile=/var/run/spamd.pid and I'm not using bayes.
I'm using the following extra rulesets:
70_sare_adult.cf
70_sare_header0.cf
70_sare_html0.cf
70_sare_oem.cf
70_sare_random.cf
70_sare_specific.cf
70_sare_stocks.cf
70_sare_uri0.cf
72_sare_bml_post25x.cf
72_sare_redirect_post3.0.0.cf
99_sare_fraud_post25x.cf
Updated with rulesdujour.
When I reboot the server the 3 children all use ~ 10% of the memory
according to ps. and after an hour or so the memory usage is going wild.
I've searched the logfiles and the strange thing is: at first when spamd
uses ~75% of the memory, there is nothing to be done; The exim4 logfiles
say there is no mail coming in or going out and there is nothing not yet
delivered. But because spamassassin seems to be busy with something,
exim does give this in paniclog upon new e-mail coming in:
2007-01-18 10:28:33 1H7TTB-0005kD-VT spam acl condition: cannot parse
spamd output
/var/log/mail.info at that time says:
Jan 18 10:28:37 localhost spamd[21074]: server hit by SIGCHLD
Jan 18 10:28:39 localhost spamd[21074]: handled cleanup of child pid 21076
Jan 18 10:28:39 localhost spamd[21074]: server successfully spawned
child process, pid 22177
Jan 18 10:28:40 localhost spamd[21077]: connection from localhost
[127.0.0.1] at port 47584
Jan 18 10:28:40 localhost spamd[21077]: info: setuid to nobody succeeded
Jan 18 10:28:45 localhost spamd[21077]: checking message
<[EMAIL PROTECTED]> for nobody:65534.
and the exim mainlog:
2007-01-18 10:28:33 1H7TTB-0005kD-VT spam acl condition: cannot parse
spamd output
2007-01-18 10:28:33 1H7TTB-0005kD-VT H=marge.gardenrs.net
[81.23.247.163] U=postfix Warning: ACL "warn" statement skipped:
condition test deferred:
Anyone any idea what could cause this behavior and what I can do about it?
Greeting,
Klaas Schaafsma
