Spamassassin and server load

[phoenixisp]

I have a Project Gamera box that all of a sudden is having a problem with the server load. When I run top it seems that the spamd process isn't stopping. I'll get a dozen or so with times of 0.25.00 and the load goes up to 7 or 9. If I restart spamassassin the load goes back to a normal stage - for a while. Then it starts sky rocketing again. I've checked the bayes_seen file and it is not large. This just started happening about a day or two ago - any ideas?

Thanks,
Sonny

[scott]

any other changes happen on the system recently? Ive seen a CPAN updated module cause problems like that

[phoenixisp]

Nope, nothing at all. That's what is bothering me. I have 2 Gamera boxes and only one has this issue. I have added a cronjob that restarts spamassassin every 3 minutes and that is keeping it okay for now. But I would like to find the problem if possible.

Could it be hardware related?

[scott]

Could be, Id check dmesg for errors. barring that you'd need to throw spamd into debug mode to see what its doing

[phoenixisp]

How would I do that Scott? And where do I find the debug results?

[scott]

I forget off the top of my head, check the man page on spamd:

man spamd

[phoenixisp]

In poking around I notice a couple of major differences between the 2 servers. The 'bad' one has very large maillog files in /var/log - they are around 10 gigs. Also in /var/spool/qsan/.spamassassin there are about 20 files named auto-whitelist.locked, a bayes_seen file and a bayes_toks file. Finally in /var/spool/qscan/tmp there are about 30 folders that do not 'go away and reappear' (i know - real tech language). Does this tell you anything?

BTW - man spamd did not have any settings for debug that I could find.

Thanks Scott

[scott]

From the man page for spamd:

-D, --debug[=areas] Print debugging messages (for areas)

Are all the files in .spamassassin read/write by the qscand user?

[phoenixisp]

The /var/qmail/.spamassassin directory as well as the files contained in it are user: qmailq and group: qmail.

In /var/spool/qscan/.spamassassin everything is qscand

/etc/mail/spamassassin is root:root as well as everything in it.

[scott]

yeah Id take a look at whats going on with spamd then. That all looks OK to me

[phoenixisp]

Thanks Scott. So what should I do? Stop spamassassin then:

/etc/init.d/spamd start -D

[scott]

/usr/bin/spamd -D I think

[phoenixisp]

Would this be causing it? [853] warn: Malformed UTF-8 character (unexpected non-continuation byte 0x00, immediately after start byte 0xd0) in pattern match (m//) at /etc/mail/spamassassin/70_sareobfu.cf, ruleSARE-OBFU-PRESC-SP1, line 1, <GEN43> line 273.

I see lines like that for a couple of the rules.

Hey man, I really appreciate you working through this for me - and teaching me along the way.

[scott]

Maybe, its tough to say from just that. Its certainly not a working rule so Id start by backing things out one by one. You might want to try running it in local checks mode too, that would rule out dcc, razor, rbls, pyzor, etc

[phoenixisp]

Just a follow up, it was hardware related. About an hour after my last post here the power supply went up on the server. After replacing it there are no more issues. Thanks for the effort Scott.