MailScanner eats memory out

[Arthur Sherman]

> > Hi,
> > 
> > This started recently, probably after I have installed RDJ.
> > 
> > The server has 1GB of memory and was happily utilizing ~300 of it.
> > Now it eats up everything.
> > When I rebooted the server and checked 'top' there hardly was
> > 30MB free, which then climbed to ~120MB.
> > 
> > 'ps' shows this:
> > ---
> > [root at ns1 ~]# ps -eo\%cpu,\%mem,size,rss,pid,cmd  |sort -rnk1
> >> head -20
> >  3.6 18.6 240324 193140 3056 MailScanner: waiting for messages
> >  3.5 16.6 240316 171920 3023 MailScanner: waiting for messages
> >  3.4 16.2 240316 168192 3022 MailScanner: waiting for messages
> >  3.4 15.4 240380 160320 3021 MailScanner: waiting for messages
> >  3.3 12.2 240316 126784 2279 MailScanner: waiting for messages
> >  0.3  0.0 1476 508   1 init [3]
> > 
> >  0.2  0.0 0    0    40 [kswapd0]
> > %CPU %MEM SZ RSS   PID CMD
> >  0.0  0.6 44492 6520 2212 clamav-milter
> > --config-file=/etc/clamd.conf --max-children=10 --force-scan
> > --quiet --dont-log-clean --noreject -obl
> > local:/var/run/clamav/clmilter.sock
> >  0.0  0.6 17628 7164 2278 MailScanner: master waiting for
> > children, sleeping  0.0  0.4 7312 4624 2911 /usr/sbin/httpd
> > 0.0  0.3 7312 3280 2960 /usr/sbin/httpd  0.0  0.3 7312 3280
> > 2959 /usr/sbin/httpd  0.0  0.3 7312 3280 2479 /usr/sbin/httpd
> >  0.0  0.3 7312 3280 2478 /usr/sbin/httpd  0.0  0.3 7312 3280
> > 2477 /usr/sbin/httpd  0.0  0.3 7312 3280 2476 /usr/sbin/httpd
> >  0.0  0.3 7312 3256 2475 /usr/sbin/httpd  0.0  0.3 7312 3240
> > 2474 /usr/sbin/httpd  0.0  0.3 7312 3236 2473 /usr/sbin/httpd
> > ---
> > 
> > Which clearly shows that MS is responcible for this.
> > Please mention that this was in quitest time - actually no
> > mails at that time in maillog.
> > 
> > Does anyone has a clue what to do in this case?
> 
> Which rulesets did you get from RDJ?  I'd remove them and start adding
> one by one until you find the culprit.
> 
> Mike

Well, actually I have added almost everything.
Now, there comes next question: what rules do you use with RDJ?
I'll take it to another thread better...


Best,

--
Arthur Sherman

+972-52-4878851
CPTeam