Milter-greylist

we are using version 2.02 and encounter the problem, that
milter-greylist suddenly stops working.
There is only one process left with a pid that�s different from the
pid in /var/run/...pid
restart fails. 
it only succeeds when I remove the greylist.db.
any idea?

We have 3 MX, each of them with 1 GB RAM, sendmail 8.13.8
50-80000 Mails per day per server

Bests 
Hans

Follow up

the crash happens on an a daily basis.
i can see an "error connecting to the socket" in the logfiles.
the pid given by ps differs from the pid in the .pid file (how can
this happen?).
In this case I have to kill the milter-process and then restart is fine.
I suppose there is a lack of memory but things like free or top show a
healthy state. greylist.db is about 80MB. Any hints how I can track
down the problem?
Is the new 3.04rc the better choice and stable enough to use in
production server?

hans


--- In milter-greylist@yahoogroups.com, "hwdahm" <hwdde@...> wrote:

>
> we are using version 2.02 and encounter the problem, that
> milter-greylist suddenly stops working.
> There is only one process left with a pid that´s different from the
> pid in /var/run/...pid
> restart fails. 
> it only succeeds when I remove the greylist.db.
> any idea?
> 
> We have 3 MX, each of them with 1 GB RAM, sendmail 8.13.8
> 50-80000 Mails per day per server
> 
> Bests 
> Hans
>

On Fri, Oct 13, 2006 at 06:26:13AM -0000, hwdahm wrote:
> In this case I have to kill the milter-process and then restart is fine.
> I suppose there is a lack of memory but things like free or top show a
> healthy state. greylist.db is about 80MB. Any hints how I can track
> down the problem?

1) you hit a memory limit (set with limit/ulimit)
2) you use DNSRBL or SPF and you linked with a thread-unsafe DNS resolver

> Is the new 3.04rc the better choice and stable enough to use in
> production server?

I use it on a pair of production MX.

-- 
Emmanuel Dreyfus
manu@...

1) unlimited
2) no SPF

I think, something is eating up my memory. I can see "VM: killing
process sendmail" in my log, so I suppose, the memory is the
bottleneck. Would it be helpful to limit the sendmail processes by
e.g. MaxDaemonChildren?

Sorry to ask dumb questions but I am new to sendmail and greylisting
with sendmail (more experienced with other mta;-)

--- In milter-greylist@yahoogroups.com, Emmanuel Dreyfus <manu@...> wrote:
>
> On Fri, Oct 13, 2006 at 06:26:13AM -0000, hwdahm wrote:
> > In this case I have to kill the milter-process and then restart is
fine.
> > I suppose there is a lack of memory but things like free or top show a
> > healthy state. greylist.db is about 80MB. Any hints how I can track
> > down the problem?
> 
> 1) you hit a memory limit (set with limit/ulimit)
> 2) you use DNSRBL or SPF and you linked with a thread-unsafe DNS
resolver

> 
> > Is the new 3.04rc the better choice and stable enough to use in
> > production server?
> 
> I use it on a pair of production MX.
> 
> -- 
> Emmanuel Dreyfus
> manu@...
>

Please don't top-quote.  It destroys the logical context of
emails.  

hwdahm wrote:
 > I think, something is eating up my memory. I can see "VM: killing
 > process sendmail" in my log, so I suppose, the memory is the
 > bottleneck.

I don't remember what OS you said you're using, but if
the VM is killing processes, that usually means that
you're running out of virtual memory (i.e. RAM + swap).
How much RAM and how much swap do you have configured?
And how much of the swap is in use?

Depending on your OS, you should be able to add more
swap on the fly (e.g. by adding a swap file).  It won't
make things go faster, but at least it will prevent
your processes from being killed.  Of course, it is
better to add more RAM _and_ more swap.  (Adding only
RAM will help in the short run, but it will actually
lower the safety margin that your swap provides.)

 > Would it be helpful to limit the sendmail processes by
 > e.g. MaxDaemonChildren?

I don't think so.  It won't solve the problem, it might
only change the symptom (i.e. rejecting mails, instead
of killing processes which -- in effect -- also results
in rejected mails).

Best regards
   Oliver

-- 
Oliver Fromme,  secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing
Dienstleistungen mit Schwerpunkt FreeBSD: http://www.secnetix.de/bsd
Any opinions expressed in this message may be personal to the author
and may not necessarily reflect the opinions of secnetix in any way.

"If Java had true garbage collection, most programs
would delete themselves upon execution."
        -- Robert Sewell

On Fri, Oct 13, 2006 at 12:03:39PM -0000, hwdahm wrote:
> I think, something is eating up my memory. I can see "VM: killing
> process sendmail" in my log, so I suppose, the memory is the
> bottleneck. Would it be helpful to limit the sendmail processes by
> e.g. MaxDaemonChildren?

Definitely. You risk your machine getting overloaded if you don't limit
the number of connections to your Sendmail. That was already a problem
with the spam load in the last century (I can remember having to
reconfigure a customer machine back then) and the situation only got
worse since then.

	Kind regards

-- 
Matthias Scheler                                  http://zhadum.org.uk/

No! That was an easy answer :) To give you an idea, the milter processes mail 
faster than sendmail itself does. Odds are your sendmail might be doing 
something silly like RBLs or additional miltering. We process on one box 
about 1million emails a day with no limit to the max number of children. The 
milter maxes out at 250ish children (sometimes it gets into an issue where it 
runs out of children), but we count only a few dozen messages that bypass the 
milter. This is on a heavily loaded box to boot. If sendmail is doing 
anything other than basic procmail delivery and greylisting, its likely that 
is your problem, due to poor or misconfiguration. I have never ever ever had 
memory or load issues due to the milter. If anything, we have seen a marked 
decrease in load, since less mail is being delivered via complex procmail 
rules we have set up.

On Friday 13 October 2006 09:26 am, Oliver Fromme wrote:
>  > Would it be helpful to limit the sendmail processes by
>  > e.g. MaxDaemonChildren?

> Would it be helpful to limit the sendmail processes by
> e.g. MaxDaemonChildren?
> 
It may make sense if your system resources are limited, especially CPU
and memory.
It is better to continue serving the already established connections,
than allowing a lot of connections and no progress on them.
If you have to do artificial limit, it is better to put at the earliest
stage, so MaxDaemonChildren is a good candidate. I am doing this on
small Tru64 UNIX servers dates back to 1993 with 128 Mbyte of RAM, and 
175 MHz CPU.
If you use MaxDaemonChildren restriction do not forget to tune different
SMTP connection timeout values, since hanging connections may make
your server unusable.

Bests,
Attila