Re: Dozens of qmail-smtpd processes eating 100% of CPU

[Alex Kirk <alex.kirk@sourcefire.com>]

That doesn't make a lot of sense...I can't think of any reason why 
tcpserver would be restarting (no other processes are running under 
tcpserver, I'm not killing it). Could it be that my softlimit is too 
low, and it's somehow restarting itself? I've got memory to spare, so I 
wouldn't mind increasing it.
Alex Kirk
> It seems like tcpserver is being restarted while there is already a 
> tcpserver running.
> u get the "unable to bind", and your PS's shows tcpserver with 2 
> different pids. suggestive that you are trying to run 2 or more 
> tcpserver's at the same time.
> seems like one of the qmail processes is/are getting a core dump 
> status of 256. I cant tell if thats you ( via kill ) or legit program 
> failure.
> Alex Kirk wrote:
>
> > @40000000464db272146d1294 tcpserver: end 27580 status 256
> > @40000000464db27218ab8764 tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db2732a4c4cec tcpserver: status: 35/50
> > @40000000464db27928807244 qmail-smtpd: not in validrcptto: 
> > Contact@schnarff.com at 71.16.199.73
> > @40000000464db27b1ef76fd4 tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db27c0d635c4c tcpserver: end 15227 status 0
> > @40000000464db27c304254fc tcpserver: status: 34/50
> > @40000000464db27e2ec1527c tcpserver: end 11521 status 0
> > @40000000464db27f1f91f284 tcpserver: status: 33/50
> > @40000000464db2863079ef5c tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db291015d20f4 tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db29a125496bc tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db2a102ec311c tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db2a506afccb4 tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db2a521545b34 tcpserver: end 16989 status 256
> > @40000000464db2a614ecd984 tcpserver: status: 32/50
> > @40000000464db2aa16aa6fd4 tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db2b21e132284 tcpserver: fatal: unable to bind: address 
> > already used
> > @40000000464db2b4398be154 tcpserver: status: 33/50
> > @40000000464db2b51910b5bc tcpserver: pid 18767 from 61.7.160.54
> > @40000000464db2b51f6796c4 tcpserver: status: 34/50
> > ...
> >
> > * Samples of output of "ps aux | grep -i qmail" (don't have any with 
> > dozens of qmail-smtpd right now, since I'm manually killing these 
> > processes before they swamp the server for the moment):
> > schnarff.com:/var/log/qmail/smtpd$ ps aux | grep -i 
> > qmail-smtpd                                                                                                                                                                 
> >
> > qmaild   20862 35.5  0.3   484  1392 ??  R     10:34AM    1:58.48 
> > /var/qmail/bin/qmail-smtpd                                                                                                                                    
> >
> > qmaild   23417 29.7  0.3   460  1400 ??  R     10:36AM    0:15.72 
> > /var/qmail/bin/qmail-smtpd                                                                                                                                    
> >
> > qmaild   28459 27.5  0.3   476  1432 ??  R     10:36AM    0:03.64 
> > /var/qmail/bin/qmail-smtpd                                                                                                                                    
> >
> > qmaild   26008 25.6  0.3   604  1416 ??  R     10:36AM    0:11.86 
> > /var/qmail/bin/qmail-smtpd                                                                                                                                    
> >
> > root     13548  0.0  0.1   260   336 ??  I     10:07AM    0:00.02 
> > supervise 
> > qmail-smtpd                                                                                                                                         
> >
> > qmaild   21751  0.0  0.1   464   496 ??  S     10:33AM    0:00.01 
> > /usr/local/bin/tcpserver -v -R -l schnarff.com -x /etc/tcp.smtp.cdb 
> > -c 50 -u 1012 -g 1005 0 smtp 
> > /var/qmail/bin/qmail-smtpd                                  qmaild   
> > 26311  0.0  0.1   264   692 ??  S     10:36AM    0:00.01 
> > /var/qmail/bin/qmail-smtpd                                                                                                                 
> >
> > schnarff.com:/var/log/qmail/smtpd$ ps aux | grep -i 
> > qmail-smtpd                                                                                                                                                                 
> >
> > qmaild    6570 95.5  0.3   376  1416 ??  R     10:32AM    0:31.39 
> > /var/qmail/bin/qmail-smtpd                                                                                                                                    
> >
> > root     13548  0.0  0.1   260   336 ??  I     10:07AM    0:00.02 
> > supervise 
> > qmail-smtpd                                                                                                                                         
> >
> > qmaild    5794  0.0  0.1   316   500 ??  S     10:31AM    0:00.01 
> > /usr/local/bin/tcpserver -v -R -l schnarff.com -x /etc/tcp.smtp.cdb 
> > -c 50 -u 1012 -g 1005 0 smtp /var/qmail/bin/qmail-smtpd      I'd 
> > appreciate any information at all on what might be causing this, and 
> > will be more than happy to supply additional info as necessary to 
> > help diagnose.
> > Thanks,
> > Alex Kirk