Extreme incoming Email killing CPu
Posted: Wed Jul 31, 2013 5:09 am
Hello,
Over the past couple of weeks, my server has seen a huge increase in incomming email.
Hundreds of connections at a time to server are causing spamd to cosnume massive ammounts of CPU.
System load often runs at 15/20/20 and is causing me all kinds of sissues.
Can anybosy suggest a way to investigate and reduce the load?
Sample of maillog
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126847]: /var/qmail/bin/relaylock: mail from 24.232.235.168:52393 (ol168-235.fibertel.com.ar)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126780]: /var/qmail/bin/relaylock: mail from 95.56.10.169:10139 (95.56.10.169.megaline.telecom.kz)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126851]: /var/qmail/bin/relaylock: mail from 91.98.228.214:12577 (91.98.228.214.pol.ir)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126853]: /var/qmail/bin/relaylock: mail from 201.4.160.220:18176 (201-4-160-220.user.veloxzone.com.br)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126802]: /var/qmail/bin/relaylock: mail from 41.138.52.126:51642 (not defined)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126855]: /var/qmail/bin/relaylock: mail from 91.218.221.94:6688 (mail.dokltd.ru)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126856]: /var/qmail/bin/relaylock: mail from 89.67.28.11:14100 (89-67-28-11.dynamic.chello.pl)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126858]: /var/qmail/bin/relaylock: mail from 213.139.25.251:2503 (not defined)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126861]: /var/qmail/bin/relaylock: mail from 202.154.112.180:20698 (mail.howas.com.au)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126860]: /var/qmail/bin/relaylock: mail from 111.91.234.78:24684 (not defined)
Over the past couple of weeks, my server has seen a huge increase in incomming email.
Hundreds of connections at a time to server are causing spamd to cosnume massive ammounts of CPU.
System load often runs at 15/20/20 and is causing me all kinds of sissues.
Can anybosy suggest a way to investigate and reduce the load?
Sample of maillog
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126847]: /var/qmail/bin/relaylock: mail from 24.232.235.168:52393 (ol168-235.fibertel.com.ar)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126780]: /var/qmail/bin/relaylock: mail from 95.56.10.169:10139 (95.56.10.169.megaline.telecom.kz)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126851]: /var/qmail/bin/relaylock: mail from 91.98.228.214:12577 (91.98.228.214.pol.ir)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126853]: /var/qmail/bin/relaylock: mail from 201.4.160.220:18176 (201-4-160-220.user.veloxzone.com.br)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126802]: /var/qmail/bin/relaylock: mail from 41.138.52.126:51642 (not defined)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126855]: /var/qmail/bin/relaylock: mail from 91.218.221.94:6688 (mail.dokltd.ru)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126856]: /var/qmail/bin/relaylock: mail from 89.67.28.11:14100 (89-67-28-11.dynamic.chello.pl)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126858]: /var/qmail/bin/relaylock: mail from 213.139.25.251:2503 (not defined)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126861]: /var/qmail/bin/relaylock: mail from 202.154.112.180:20698 (mail.howas.com.au)
Jul 30 14:30:23 sa1 /var/qmail/bin/relaylock[126860]: /var/qmail/bin/relaylock: mail from 111.91.234.78:24684 (not defined)