My miab (about 15 users) has been running perfectly for about 4 or 5 months, but suddenly has started having problems. When I SSH in and do top I see many sa-learn processes (about 10–15 of them) using almost 100% of the CPU between them. The whole machine is of course very unresponsive due to this; emails are not being delivered etc
Can anyone suggest why this might be happening, and what I can do to debug it and/or rectify it?
I am not sure why, but maybe a reboot is in order? or if you restart the spam-assassin service? Gotta clear up that process before you can do troubleshooting.
Sorry, I should have mentioned that I have rebooted it twice prior to posting the issue. It always just comes up and pretty much straight away sa-learn kicks in, the same as above. It’s now been on 100% CPU for over 24 hours.
I can’d find definitive instructions on restarting spam-assassin; do you know the command by any chance?
Finally, it seems that if sa-learn is allowed by MIAB to swamp the server’s resources like this (particularly RAM and CPU) then that’s a problem that should be possible to overcome, using nice or something? It seems that MIAB spawns 20 sa-learn’s, each reading directly from /tmp/sendmail-msg-xxxxx.txt. Why spawn 20 then? Why not 10?
It’s probably a bug of some sort, but try:
/etc/init.d/spamassassin stop
And start troubleshooting.
NOTE: You might not receive email while it is offline, I am not sure how SA/Postfix is configured to work together at this point (I am no longer running MIAB)
Thanks for your help — much appreciated! 
Thanks also for your command to stop spam assassin. Re subsequent troubleshooting; do you know where the mail is stored by spampd before being processed by sa-learn? I would have liked to see exactly how big the pile of mail was, that sa-learn was working its way through.
As suddenly as it started, after about 26 hours of 100% CPU usage (and thus of course rendering the mail server only marginally alive), the high CPU usage suddenly stopped and everything returned to normal.
I really have no explanation for it, which makes me nervous as I have no idea if/when it might happen again, nor do I have any idea really how to fix it if it does.
Honestly I am not sure, it might just process mail in the mail directory for each user - not too sure.
yes I have the same problem, actually i created scripts to reduce the volume of spam inside each user’s folders, and minimize sa-learn processes
find /home/user-data/mail/mailboxes/*/*/.Spam/cur/* -mtime +2 -exec rm {} \;
There is a solution to restart SA and reset the memory?
Good morning.
I state that I am not an expert in relation to this command line. If I have interpreted it correctly, does it automatically remove files older than 2 days?
I would have idea to apply the same logic to the .Trash/cur/ folder
Thank you
