MailScanner memory spikes

[Edward L. Hannaford]

> The grandchildren are normal. When MS runs the virus scanner checks, SA
>checks, file checks (pretty much any external input I think), it'll fork
off
>a process to run the command. This allows it to keep track if the
grandchild
>has been running longer than the set timeout. Nothing to worry about.
>
> If it turns out that one of these grandkids is the memory hog, it could be
>that the problem is actually with your virus scanner or SA.

- Hmmm.  Okay.  Good to know that they're normal.  Do you know of any way
to tell what external input the grandchild is implementing?  I'd love to
saddle this on some other process!

> Do you happen to have any system accounting enabled on the server to
>monitor CPU/Memory usages throughout the day? In Linux, this package is
>generally called sysstat.

- I have sysstat installed so that I can run mailscanner-mrtg (I *love*
those stats, although I've had to work on how they're gathered).  Can you
suggest any method, either with sysstat or mailscanner-mrtg, to help
analyze just what's going on?

> So you say this happens every 12 or 13 hours.. Does anything match up in
>your mail logs? IE: really big attachments, email from/to the same person,
>etc.

- I've looked hard in maillog at what was recorded during those spikes and
I haven't been able to spot any correlations.  No stats in mailscanner-mrtg
correlate either, except for memory usage and CPU utilization, i.e. no
surge in email, virii, spam, MB of mail, or anything else I can spot.

-Ed