I’ve been running MIAB for years, but just today sa-learn started going crazy, spawning hundreds of processes and eating all available RAM. I saw that this has come up before, but rebooting doesn’t help. Restarting the dovecot process makes everything calm down, but it soon restarts. I have disabled it by commenting out the pipe commands in /etc/dovecot/conf.d/99-local-spampd.conf, but obviously that is just avoiding the problem by introducing another.
I’ve no idea why this is going amiss – any pointers?
No, I’ve not added any new users lately. Even then, I’d expect some kind of throttling or process count limiting to prevent this kind of runaway. I had to force a reboot earlier because it didn’t have enough memory to let me log in! It seems quite happy to launch hundreds of instances of sa-learn in parallel.
I have not, but I don’t think I’d be able to tell if any other users did? Even then, I can’t see why a new client would cause sa-learn to be triggered for every message. To be fair, I don’t know what operations do or don’t trigger it.
I know the sa-learn script is automagically invoked whenever mail is moved in or out of the spam folder. I’m not sure what would happen if you had like years worth of spam in a spam folder and decided to move them to /outlookmail/junk in a single operation, or whatever the client devs think is a better location for spam.
There is also the ol’ sudo mailinabox command that frequently magically solves problems.
It would be great to get to the bottom of this. In all the years I’ve run it, it’s the only thing that has ever been unreliable in MIAB. The only thing I’ve been able to do is wait for it to finish, which it inevitably does; took 26 hours in May 2018, 22 hours in Feb this year and 8 hours in April, but after the wait it was all fine. Luckily mail is resent by the other ends’ SMTP servers so I don’t think I lost any incoming mail during the downtime.
I’ve been able to SSH in during these scenarios (all running extremely slowly though) but I couldn’t really ascertain any cause.
Incidentally, I have run two MIAB servers for several years, and it’s only ever happened to one of them. They are with different hosts, but software-wise are virtually identical.