Got any Linux Guru's? Server Load questions...

[Pako]

Currently running a Linux dedicated server and have for some time now. About three weeks ago, my SMTP services started to shut down because of high server loads being caused by sendmail and MailScanner. I have since removed my catch-all accounts created by Ensim as well as increase the server load triggers from 8 to 14 to allow emails to get delivered. Unfortunately, the server load averages are around 12, 10, 12 on a regular basis. Any suggestions on tracking this down? I have a suspicion that I might have some PHP scripts sending out spam at an alarming rate, causing the high server loads but how do you check what processes are calling the 'sendmail' process? Why is MailScanner causing such a high load as well? If I were to migrate to another server, should I stick with a Linux box or go with a Windows box with ASP as well as PHP functionality? Thanks to look out for with migrating to another server? I'm only looking at 16 domains, 2 domain servers, and three static IP address. Ideas?

Thanks...

 

[BobK]

Have you tried ps(1) with one of the options to display parent PIDs? "ps axjf" would do this, there are other option combinations that would work too.

You might also want to play with ethereal or some other packet sniffer to see just what's going on on port 25 and maybe 465.

 

[Pako]

Thanks for the info BobK. I was actually able to confirm that the spam coming into the server is causing the high load averages. I'm not looking into an external spam/antivirus cluster that will filter out most of the spam before it ever hits my box. Hopefully this will reduce the CPU load and keep my customers happy.