On Mon, 22 Mar 2004, Paolo Cravero as2594 wrote:
> Hi.
> An exceptionally high load of incoming messages has managed to crash
> spamd (Postfix + SpamAssassin 2.62 on a dual Xeon 2G4).
>
> Is there a crontab script that monitors spamd health and in case
> attempts a restart and/or warns a sysadmin?
>
> For those interested, Murphy made this happen on Friday night so
> until Monday morning half of incoming mail was not spam-filtered (we're
> running under load balancing). They were about 2500 msg/h (41 msg/min)
> incoming generated by a vacation-reply loop (vacation reply to an
> unknown mailbox, bounce, vacation reply to bounce, etc etc).
I can't help you with the stay-alive script, but have another
type of suggestion. Check your Postfix to see if it has some kind
of rate/load limiting feature. (IE configure it to deny or queue-only
if the incoming connections get above a certain rate, or if the
load/resource usage gets to high).
We use sendmail and I've got it configured with rate limit thresholds
to defend spamd from mail-bomb attacks (externally or internally
generated ;).
Reasonable rate limiting has totally cured our SA from overload deaths.
One other trick to survive forward-loops or reply-ping-pongs, configure
your system so that if you've SA filtered a given message once, skip
it if you see it again. (IE if it already has a SA header added by
your system, don't bother to filter it again).
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
