too many sendmail processes

[Nivesh Patnaik]

Hello,

I have a 9000/712 workstation receiving e-mails from several systems. The 712 box is completely bogged down. When I do:
ps -ef |grep sendmail
I get 140 odd processes that look like:

root 589 1 0 14:00:41 ? 0:00 /usr/sbin/sendmail -q30m -- only one of this kind actually
root 23041 543 0 10:12:01 ? 0:00 /usr/sbin/sendmail -bs -oL10
root 22899 543 0 10:04:09 ? 0:00 sendmail: server root@b888 [ppp.
qqq.rrr.sss] child wait
root 22805 22797 0 09:58:52 ? 0:00 sendmail: JAA22805 root@[rrr.ppp
.qqq.ttt]: DATA

I have no idea why so many process of the type above are being spawned. I rebooted the server but the processes built up again and bogged the system down at an average load of over 80,
which is terrible because the 712 box is only used as a mail repository.

I can provide more info as necessary. Please help.

Nives

[Craig Rants]

Is the system load high? If so follow this excerpt from the sendmail.cf file.

In order to limit load on a very busy system, the sendmail daemon #
# can be configured not to accept SMTP connections if the five- #
# minute load average is greater than some integer value, by #
# default 12. This value is defined on the line beginning #
# O RefuseLA=.

GL,
C

[Craig Rants]

You could also edit this value:

# maximum number of new connections per second
#O ConnectionRateThrottle=3

HH,
C

[Mark Greene_1]

Have you traced the Parent Pids of the various processes back to their source processes? Also, as root run mailq -v -d and see if your basic configuration is correct, and how much and what sort of mail may be stacking-up in the queue.

HTH
--
mark

[Craig Rants]

Ok, so I didn't read well, you load got to over 80, I am suprised that you could even login. So my first reply will probably help, but you will want to trace down the orgination of all you mail, are you getting a DoS?

MC,
C

[Sanjay_6]

Hi Nivesh,

Give this sample a try,

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=8efa4c21160ec530fc/screen=ckiDisplayDocument?docId=200000024603555

Hope this helps.

Regds

[Nivesh Patnaik]

I get a bunch of e-mails which are a part of a system reporting process...not a denial of service attack here. I am able to login, but I can barely do anything on the system. I will try all your suggestions and see if that helps. Much thanks.
-Nivesh

[Nivesh Patnaik]

Most of the sendail processes had a PPID pointing back to /usr/sbin/inetd daemon.
Now the number of sendmail processes is 157.

I didn't find ConnectionRateThrottle in sendmail.cf.

What could be causing it?

[Nivesh Patnaik]

Found this line in /etc/inetd.conf:

smtp stream tcp nowait root /usr/lbin/tcpd /usr/sbin/sendmail -bs -oL10

...?

[Mark Greene_1]

do /sbin/init.d/sendmail stop to stop sendmail. This will also stop any new processes. They you can kill all the other sendmail processes. Given what you said the output was, check the crontabs to see if this mail is being generated by a scheduled job. If so, comment that job in the crontab, and then restart sendmail using /sbin/init.d/sendmail start. Then do (as root) mailq -v -d to verify your sendmail config. Maybe also check the frequency of the report process as setup in cron (if that is the case).

HTH
--
mark