Hallo list, receiving a bunch of obvious spam emails without the SA tags in it made me look at my logfiles and I found out - thats what I guess - that for a short time my server was reaching his limits. Short grep extracts from my logfile:
Mar 21 10:22:56 h1306680 spamd[9247]: prefork: child states: II Mar 21 10:54:11 h1306680 spamd[9247]: prefork: child states: II Mar 21 11:00:13 h1306680 spamd[9247]: prefork: child states: BB Mar 21 11:01:43 h1306680 spamd[9247]: prefork: child states: IBI Mar 21 11:07:40 h1306680 spamd[9247]: prefork: child states: BIB Mar 21 11:12:53 h1306680 spamd[9247]: prefork: child states: BBB Mar 21 11:13:11 h1306680 spamd[9247]: prefork: child states: BBBB Mar 21 11:14:28 h1306680 spamd[9247]: prefork: child states: BBBBI Mar 21 11:14:48 h1306680 spamd[9247]: prefork: child states: BBBBB Mar 21 11:15:31 h1306680 spamd[9247]: prefork: server reached --max-children setting, consider raising it Mar 21 11:16:01 h1306680 spamd[9247]: prefork: child states: BBBBB Mar 21 11:16:10 h1306680 spamd[9247]: prefork: server reached --max-children setting, consider raising it Mar 21 11:16:22 h1306680 spamd[9247]: prefork: child states: BBBBB Mar 21 11:17:16 h1306680 spamd[9247]: prefork: server reached --max-children setting, consider raising it Mar 21 11:17:38 h1306680 spamd[9247]: prefork: child states: BBBBB Mar 21 11:17:38 h1306680 spamd[9247]: prefork: server reached --max-children setting, consider raising it Mar 21 11:17:38 h1306680 spamd[9247]: prefork: child states: BBBBB Mar 21 11:17:55 h1306680 spamd[9247]: prefork: server reached --max-children setting, consider raising it Mar 21 11:17:55 h1306680 spamd[9247]: prefork: child states: BBBBI Mar 21 11:17:55 h1306680 spamd[9247]: prefork: child states: IBBBI Mar 21 11:18:09 h1306680 spamd[9247]: prefork: child states: IBBII Mar 21 11:18:09 h1306680 spamd[9247]: prefork: child states: IBBIK Mar 21 11:18:13 h1306680 spamd[9247]: prefork: child states: IIBI Mar 21 11:18:50 h1306680 spamd[9247]: prefork: child states: IIB Mar 21 11:19:04 h1306680 spamd[9247]: prefork: child states: III Mar 21 10:22:56 h1306680 spamd[3550]: spamd: identified spam (22.1/5.0) for popuser:110 in 3.1 seconds, 1096 bytes. Mar 21 10:59:07 h1306680 spamd[9310]: spamd: identified spam (16.4/5.0) for popuser:110 in 116.4 seconds, 4195 bytes. Mar 21 10:59:08 h1306680 spamd[3550]: spamd: identified spam (16.4/5.0) for popuser:110 in 132.1 seconds, 4195 bytes. Mar 21 11:04:49 h1306680 spamd[9310]: spamd: identified spam (16.9/5.0) for popuser:110 in 275.9 seconds, 4195 bytes. Mar 21 11:11:48 h1306680 spamd[3550]: spamd: identified spam (32.3/5.0) for popuser:110 in 373.2 seconds, 17910 bytes. Mar 21 11:12:47 h1306680 spamd[30139]: spamd: identified spam (14.8/5.0) for popuser:110 in 412.3 seconds, 4164 bytes. Mar 21 11:13:13 h1306680 spamd[9310]: spamd: identified spam (15.3/5.0) for popuser:110 in 115.2 seconds, 4164 bytes. Mar 21 11:14:22 h1306680 spamd[3550]: spamd: identified spam (15.6/5.0) for popuser:110 in 88.2 seconds, 4164 bytes. Mar 21 11:16:08 h1306680 spamd[32043]: spamd: identified spam (20.3/5.0) for popuser:110 in 176.5 seconds, 3958 bytes. Mar 21 11:16:22 h1306680 spamd[30139]: spamd: identified spam (16.8/5.0) for popuser:110 in 114.4 seconds, 3980 bytes. Mar 21 11:16:39 h1306680 spamd[9310]: spamd: identified spam (20.3/5.0) for popuser:110 in 111.8 seconds, 3958 bytes. Mar 21 11:17:00 h1306680 spamd[32266]: spamd: identified spam (20.3/5.0) for popuser:110 in 131.9 seconds, 3958 bytes. Mar 21 11:17:44 h1306680 spamd[3550]: spamd: identified spam (16.8/5.0) for popuser:110 in 102.5 seconds, 3980 bytes. Mar 21 11:18:01 h1306680 spamd[32043]: spamd: identified spam (16.8/5.0) for popuser:110 in 98.1 seconds, 3980 bytes. Mar 21 11:18:13 h1306680 spamd[9310]: spamd: identified spam (27.8/5.0) for popuser:110 in 34.5 seconds, 3166 bytes. Mar 21 11:18:32 h1306680 spamd[30139]: spamd: identified spam (24.0/5.0) for popuser:110 in 53.9 seconds, 1292 bytes. Mar 21 11:19:33 h1306680 spamd[3550]: spamd: identified spam (32.9/5.0) for popuser:110 in 17.7 seconds, 992 bytes. Mar 21 11:19:50 h1306680 spamd[3550]: spamd: identified spam (26.5/5.0) for popuser:110 in 10.2 seconds, 1244 bytes. Mar 21 11:20:33 h1306680 spamd[9310]: spamd: identified spam (18.1/5.0) for popuser:110 in 23.9 seconds, 1238 bytes. What I make of this is that when my server is using his maximum of 5 spamd children he hits the RAM limit and starts paging (the explosion of scanning time). Is this a sensible assessment? What could I do about it? Raising --maximum-children seems not a good idea. Actually it seems wiser to reduce to a maximum of 4 children. How can I prevent spam from passing my system unchecked due to a (temporary) overload? If I look at the prefork child states the critical time is followed by hours of II / BI. How could I queue the incoming emails and ensure that every email gets scanned? Currently I am using qmail's defaultdelivery setting: | spamc | /usr/bin/deliverquota ./Maildir Additionally some users use procmail to filter spam. Any hints and help appretiated! PM -- View this message in context: http://www.nabble.com/Server-overload%2C-queuing-for-SA-possible--tp22636540p22636540.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
