Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SpamAssassin: users

Strange behavior - load high when scanning mail from one specific user

 

 

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded


barbosa55 at gmail

Oct 9, 2008, 5:45 AM

Post #1 of 3 (146 views)
Permalink
Strange behavior - load high when scanning mail from one specific user

Hi!

I've noticed a strange behavior on a server I maintain and after 2 days
trying to figure it out by monitoring the server and searching the web I
still cannot determine the cause of the problem.

I'm running cPanel with Exim+Spamassassin.
In the last few days, during some specific periods we noticed that the
server load was unusually high (>7). After a few hours monitoring it we
noticed that every time the load went up, there was a "spamd" processed
owned by a specific user that never finished. Once we killed it the load
returned to normal values. For the past 2 days we were able to confirm this:
whenever the server had a high load, there was a spam assassin process owned
by that specific user hanging around and with a lot of cpu % time. Once we
kill it, the server load drops dramatically.

We have almost 100 accounts at that server so it must not be a coincidence
that it is always that user that owns the offending process.

The only clue we have is that the user had SpamAssassin disabled for a
while, but enabled it again last week. He has sufficient disk quota and is
not receiving an abnormal amount of emails. We tried disabling spam assassin
and re-enabling it later.

Any clues as to where I should next? any test I can perform?
--
View this message in context: http://www.nabble.com/Strange-behavior---load-high-when-scanning-mail-from-one-specific-user-tp19898283p19898283.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


bob at bobcatos

Oct 9, 2008, 11:10 AM

Post #2 of 3 (131 views)
Permalink
Re: Strange behavior - load high when scanning mail from one specific user [In reply to]

On Thu, Oct 09, 2008 at 05:45:12AM -0700, martinezpt wrote:
>
> Hi!
>
> I've noticed a strange behavior on a server I maintain and after 2 days
> trying to figure it out by monitoring the server and searching the web I
> still cannot determine the cause of the problem.
>
> I'm running cPanel with Exim+Spamassassin.
> In the last few days, during some specific periods we noticed that the
> server load was unusually high (>7). After a few hours monitoring it we
> noticed that every time the load went up, there was a "spamd" processed
> owned by a specific user that never finished. Once we killed it the load
> returned to normal values. For the past 2 days we were able to confirm this:
> whenever the server had a high load, there was a spam assassin process owned
> by that specific user hanging around and with a lot of cpu % time. Once we
> kill it, the server load drops dramatically.
>
> We have almost 100 accounts at that server so it must not be a coincidence
> that it is always that user that owns the offending process.
>
> The only clue we have is that the user had SpamAssassin disabled for a
> while, but enabled it again last week. He has sufficient disk quota and is
> not receiving an abnormal amount of emails. We tried disabling spam assassin
> and re-enabling it later.
>
> Any clues as to where I should next? any test I can perform?
> --
> View this message in context: http://www.nabble.com/Strange-behavior---load-high-when-scanning-mail-from-one-specific-user-tp19898283p19898283.html
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

We had this happen to a user a couple months ago. When we

sa-learn -u <userid> --dump magic

I think it complained about a DB version mismatch or something like
that. There's probably a more elegant solution, but we renamed (or
deleted) his bayes_* files, and that cured the problem, though he had
to start over on Bayes.

Cheers,
--
Bob McClure, Jr. Bobcat Open Systems, Inc.
bob[at]bobcatos.com http://www.bobcatos.com
Those whom I love I rebuke and discipline. So be earnest, and repent.
Revelation 3:19 (NIV)


barbosa55 at gmail

Oct 9, 2008, 2:03 PM

Post #3 of 3 (130 views)
Permalink
Re: Strange behavior - load high when scanning mail from one specific user [In reply to]

Thank you for your suggestion!

I listed the content of the user's .spamassassin folder and found some files
that were not on the other user's folders, such as:
bayes_toks.new
bayes.lock

I renamed all the files and have been monitoring the server for over an hour
and the problem has not occurred again. The files have been recreated and
the user has received new emails since the change without a problem.

Thank you again!



Bob McClure Jr-2 wrote:
>
> On Thu, Oct 09, 2008 at 05:45:12AM -0700, martinezpt wrote:
>>
>> Hi!
>>
>> I've noticed a strange behavior on a server I maintain and after 2 days
>> trying to figure it out by monitoring the server and searching the web I
>> still cannot determine the cause of the problem.
>>
>> I'm running cPanel with Exim+Spamassassin.
>> In the last few days, during some specific periods we noticed that the
>> server load was unusually high (>7). After a few hours monitoring it we
>> noticed that every time the load went up, there was a "spamd" processed
>> owned by a specific user that never finished. Once we killed it the load
>> returned to normal values. For the past 2 days we were able to confirm
>> this:
>> whenever the server had a high load, there was a spam assassin process
>> owned
>> by that specific user hanging around and with a lot of cpu % time. Once
>> we
>> kill it, the server load drops dramatically.
>>
>> We have almost 100 accounts at that server so it must not be a
>> coincidence
>> that it is always that user that owns the offending process.
>>
>> The only clue we have is that the user had SpamAssassin disabled for a
>> while, but enabled it again last week. He has sufficient disk quota and
>> is
>> not receiving an abnormal amount of emails. We tried disabling spam
>> assassin
>> and re-enabling it later.
>>
>> Any clues as to where I should next? any test I can perform?
>> --
>> View this message in context:
>> http://www.nabble.com/Strange-behavior---load-high-when-scanning-mail-from-one-specific-user-tp19898283p19898283.html
>> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>
> We had this happen to a user a couple months ago. When we
>
> sa-learn -u <userid> --dump magic
>
> I think it complained about a DB version mismatch or something like
> that. There's probably a more elegant solution, but we renamed (or
> deleted) his bayes_* files, and that cured the problem, though he had
> to start over on Bayes.
>
> Cheers,
> --
> Bob McClure, Jr. Bobcat Open Systems, Inc.
> bob[at]bobcatos.com http://www.bobcatos.com
> Those whom I love I rebuke and discipline. So be earnest, and repent.
> Revelation 3:19 (NIV)
>
>

--
View this message in context: http://www.nabble.com/Strange-behavior---load-high-when-scanning-mail-from-one-specific-user-tp19898283p19907335.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact lists@gossamer-threads.com
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.