[clamassassin-discuss] clamassasin eats my cpu resources

[James Lick]

Fake ID wrote:

>I installed clamav + clamassasin at my server and then
>created /etc/procmailrc for global. In 24 hours, my
>server died, I can even login to my server, I have to
>use  Ctrl + Alt + Del via console and disable
>clamd/clamassasin, and my server back to normally.
>Later I tried to run it again and check my process, I
>saw there is many process called procmail ( I have one
>hundred user at there).
>
>Is it possible caused by procmail ? May I use
>.procmailrc for every user (disable global
>/etc/procmailrc) ?
>  
>

If you are having load problems, I would suggest the first thing you do 
is check to make sure that clamassassin is using clamdscan and not 
clamscan.  Using clamscan with a large load of mail will clobber many 
systems.

Next, I would check what processes are using the most cpu and memory.  
For cpu, the 'top' utility is good for seeing what's using the cpu.  
(Solaris comes with prstat instead of top.)  ps is good for finding out 
what is using memory.  If there's a lot of procmail processes, it's 
possible that something is stuck.  This could be a permissions problem, 
because you are using a global procmailrc for all users.  Turning on 
logging (e.g. LOGFILE=/tmp/procmail.log) and it might show what is the 
problem.

If you don't find the problem from the above, I'd suggest you try 
enabling clamassassin for just one user and see if that helps track down 
the problem.  Please post again when you have more information on what 
is happening.

-- 
James Lick -- 黎建溥 -- jlick at jameslick.com -- http://jameslick.com/