Results 1 to 3 of 3
  1. #1
    Join Date
    May 2003
    Location
    Florida
    Posts
    902

    Exim causing excessive load

    My server is experiencing high loads today. I think it is Exim causing the problem because there are multiple copies running and all are taking resources.

    I have restarted Exim and the load does drop, but comes back. I also did a /scripts/Exim4 to reinstall.

    I don't think it is a spammer. I have tail'ed the log and also checked the queue. While I might be wrong, it does look like normal.

    Anybody have any idea of what the problem might be or where to start looking?

    Here is part of the current top.

    20:45:48 up 12:05, 2 users, load average: 20.03, 19.66, 18.28
    145 processes: 121 sleeping, 20 running, 3 zombie, 1 stopped
    CPU0 states: 96.3% user 3.0% system 0.1% nice 0.0% iowait 0.0% idle
    CPU1 states: 97.4% user 2.2% system 0.3% nice 0.0% iowait 0.0% idle
    Mem: 1029236k av, 1012580k used, 16656k free, 0k shrd, 199744k buff
    742264k actv, 296k in_d, 45756k in_c
    Swap: 2096472k av, 125228k used, 1971244k free 464420k cached

    PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
    17493 root 25 0 1856 1444 752 R 17.3 0.1 54:41 1 exim
    12382 root 25 0 3716 3716 2616 R 16.7 0.3 5:25 1 exim
    29703 root 25 0 1856 1304 752 R 15.9 0.1 16:08 1 exim
    2239 root 25 0 1940 1916 840 R 15.9 0.1 10:43 1 exim
    5648 root 25 0 2840 2392 1736 R 15.9 0.2 8:48 1 exim
    10551 root 25 0 3716 3716 2616 R 15.9 0.3 5:56 1 exim
    31317 root 25 0 1860 1860 756 R 11.9 0.1 14:07 0 exim
    2149 root 25 0 1856 1856 752 R 11.9 0.1 11:02 0 exim
    2240 root 25 0 1940 1940 840 R 11.9 0.1 11:03 0 exim
    20444 root 25 0 3720 3720 2616 R 11.9 0.3 2:30 0 exim
    13083 root 25 0 3720 3720 2616 R 11.1 0.3 5:03 0 exim
    18977 root 25 0 1852 1488 752 R 10.7 0.1 46:30 0 exim
    30271 root 25 0 1852 1852 752 R 9.9 0.1 15:54 0 exim
    8413 root 25 0 3644 3556 2540 R 9.9 0.3 6:54 0 exim
    19080 root 25 0 3716 3716 2616 R 9.9 0.3 2:37 0 exim
    15581 root 23 8 21404 16M 1848 S N 0.5 1.6 0:02 1 spamd
    28149 root 21 0 3292 3292 2472 R 0.5 0.3 0:00 1 exim
    17540 root 16 0 1284 1284 844 R 0.3 0.1 0:05 1 top
    1971 root 19 4 5132 148 80 S N 0.1 0.0 7:27 0 httpd

  2. #2
    Join Date
    Jan 2005
    Location
    USA
    Posts
    1,379
    That is a miserable load. Have you tried killing all those processes then starting up exim again? My only guess would be a dictionary attack, but I am really not sure.

    One odd thing is those processes have been running for a while it appears, that's why I suggested trying to kill them then start up exim.

  3. #3
    Join Date
    May 2003
    Location
    Florida
    Posts
    902
    Yes, I have stopped and restarted Exim a couple times. When I restart, it looks correct but gradually keeps increasing.

    I have monitored the exim_mainlog and messages files. Nothing looks really out of the normal. Wouldn't a dictionary attack show a lot of rejected email attempts?

    any other ideas?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •