While looking at a Courier server recently, I saw several esmtpd processes in a state like:
20410 ? S 2:26 /usr/lib/courier/sbin/couriertcpd -stderrlogger=/usr/lib/courier/sbin/courierlogger -nodnslookup -noidentlookup -user=daemo 3019 ? T 0:00 \_ /usr/lib/courier/sbin/courieresmtpd /usr/lib/courier/libexec/courier/modules/esmtp/authstart authdaemon 3020 ? Z 0:00 | \_ [submit <defunct>]
Other processes snipped; the important part is that submit is defunct and esmtpd had been running for a long time.
To get an idea of what it was doing, I straced it and got something similar to this:
# strace -f -p 3019 --- SIGSTOP (Stopped (signal)) --- time([1053723625]) = 1053723625 time([1053723625]) = 1053723625 rt_sigaction(SIGPIPE, {0x420e46e0, [], 0x4000000}, {SIG_IGN}, 8) = 0 send(3, "<22>May 23 14:00:25 courieresmtp"..., 180, 0) = 180 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 select(2, NULL, [1], NULL, {300, 0}) = 1 (out [1], left {300, 0}) writev(1, [{"502 ESMTP command error", 23}, {"\r\n", 2}], 2) = 25 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGCHLD, NULL, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 nanosleep({128, 0}, <unfinished ...>
The trace stopped there, while the process waited for something to happen.
It's sleeping. Automatic tarpitting, when the client starts to fling crap at the server.
A second strace produced nearly identical output, and caused a similar message to be printed into the maillog:
May 23 13:59:45 goodfellas courieresmtpd: error,relay=::ffff:202.64.208.252,msg="502 ESMTP command error",cmd: IG1LZGLJYWWGC2HVCCBHBMQGYM91DGLXDWUUPC9MB250PJWVCD4NCIAGICAGICAGPC90ZD4NCIAG
Any ideas, Sam?
Broken spamware being tarpitted.
------------------------------------------------------- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ courier-users mailing list [EMAIL PROTECTED] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
