[nycbug-talk] Odd behavior on FreeBSD 6.3 box

[Matt Juszczak]

> I have a simple webserver/mysql box that usually works fine.  But tonight, I 
> was seeing load averages in the 80's and 90's, incredibly high I/O wait, and 
> perl in the top of the processlist using 80-90% of CPU.  Seemed to be 
> spamassassin related, but I also had a ton of apache processes running.

As an update, I'm still seeing this.  This time it was this morning, and 
brought the whole box to a crawl.

I was able to do a "top" before losing my ssh to the box, and spamassassin 
(a perl process calling spamassassin) was pegged at the top.

Some research I've done shows that spamassassin has the potential to 
runaway like this, but seems to be in historic versions.  I was running 
3.2.5.

This box is FreeBSD 6.2.  I'm somewhat hoping it hasn't been compromised, 
though I know freebsd out of box (though I'm running pf as well as 
kern.securelevel of 2) with basic apache and SMTP is *knock on wood* 
harder to compromise...

Any suggestions?