Re: AW: [Exim] POP3 and Exim

On Mon, 2003-09-22 at 15:35, Wolf-Guido Lutz wrote:

> First of all, thanks to you all for your answers. I can now choose between
> quite a variety of products, and hopefully get our server back to work.
>
> I'm not entirely sure if it's qpopper (4.0.5 here too) that has the leak,
> but I need to start somewhere. When I tail the /var/log/mail and
> /var/log/exim_mainlog while watching the used memory displayed by the top
> command, I can see the memory going up steadily. There are some times when
> the memory increase coincides with a mail coming in, which would actually
> point at exim (which is version 4.22 by the way), but I have these log file
> entries from qpopper, which arrive every few minutes, so I suspected there
> could be something wrong with qpopper.

[snip]

> However, there is quite some traffic and it could be exim that causes the
> memory leak. The only other program that runs on this server is ssld.
>
> If anybody can help me on with this, I'd be _really_ glad. This is taking my
> sleep, and it started several weeks ago - just about when Sobig arrived -
> after three years without problems...

When you say you are watching `top`, and are seeing the memory used
going up with each received message and noticing a leak. Are you
subtracting the "buffers" and "cached" memory from the "used"? You do
know that Linux caches each file written as long as you have free
memory?

It does this to maximize performance. If you don't have enough programs
running to fill memory, that is just wasted RAM. So Linux uses the free
memory as a disk cache. So every file written (mail delivered) will
take some of your free memory. If that mail then gets picked up by a
user it doesn't have to go to disk to read it, it is already there in
RAM. I find it takes even a well loaded server about 48 hours to reach
a nice steady state of memory usage between running programs and disk
cache.

Of course you could have a leaking program, but I've seen enough people
confuse the output of `free` and `top` thinking they are running out of
memory, when all it is, is Linux trying to make the machine run as
smooth as possible.

--
Chris