<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>Unusual # of MailScanner processes running</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Hi all,</FONT>
</P>
<P><FONT SIZE=2>I am monitoring an unusual situation on one of two identical MS boxes. Both boxes are RH9, running MS 4.29.7 (upgraded on 4/3/04). These boxes have been running with symetric configurations for over 200 days without as much as a hiccup. </FONT></P>
<P><FONT SIZE=2>Starting at 12:30PM yesterday (4/15), one of the two boxes started running a higher than usual number of MS processes. I noticed the issue from mailscanner-mrtg which has shown almost a flatline for # of MS copies running since the box was turned up (normally run 10 copies). Starting at 12:30PM, the graph bounces between 10 and 18 copies continuously (producing a much ulglier graph). I have confirmed these are actual copies and not a script with a similar name that is being picked up by msmrtg. </FONT></P>
<P><FONT SIZE=2>I've reviewed time slice of logs (several thousand lines) from when the problem occurred and logs during the unstable operation and have found not even a clue as to what might be causing these extra processes. The identical box still shows a flat graph. </FONT></P>
<P><FONT SIZE=2>The load on these boxes is nearly identical as well (~45Kmsgs/day, 50%spam, ~2K virus). I am not noticing any performance issues on either box (other than slightly increased #ofmsgs in the queue.in on the problem box), even with the bouncing process count but it is bugging me that I cant figure out whats wrong and why this would happen independent of any changes I've made. </FONT></P>
<P><FONT SIZE=2>The changes I've made since the upgrade were the put a ruleset on the allow scripts tag to permit 3 domains. I've confirmed the MailScanner.conf and the rules file I used are exactly the same on both boxes. </FONT></P>
<P><FONT SIZE=2>Has anyone experienced anything like this in the past? Anyone have any ideas? I may go debug on the system this weekend but I'll have to schedule the downtime. </FONT></P>
<P><FONT SIZE=2>Thanks,</FONT>
</P>
<P><FONT SIZE=2>Jason</FONT>
</P>
</BODY>
</HTML>