Memory leak and deep swap upon the restart?

[Dan Nelson]

In the last episode (Mar 15), Abdullah Ibn Hamad Al-Marri said:
> Hello,
> 
> I have a webmail server, has apache 2.2.4, mysql 5.0.33, php 5.2.1,
> clamav, mailscanner ..etc.
> 
> The weird issue it goes into deep swap when it starts or I restart it. 
> *sigh*
> This happened since like 6 months I don't know why? it was okay before that.
> 
> here is the top info
> 
> last pid:   790;  load averages:  0.00,  0.06,  0.05 up 0+00:06:50  03:51:28
> 69 processes:  1 running, 68 sleeping
> CPU states:  0.0% user,  0.0% nice,  0.4% system,  0.0% interrupt, 99.6% idle
> Mem: 323M Active, 91M Inact, 56M Wired, 27M Cache, 52M Buf, 988K Free
> Swap: 2048M Total, 104M Used, 1944M Free, 5% Inuse

Right now you're only showing 100M of swap being used; that looks fine,
as long as it's not being accessed constantly (watch for "##K in, ##K
out" to appear on the Swap: line, or watch the "pi" and "po" columns of
"vmstat 5").  If you see constant swap activity, that means you'll need
to reduce the number of worker processes for your multiprocess daemons
(from your ps output, that means apache, amavisd amd MailScanner), move
some processes to another machine, or add RAM.
 
> Here is the ps -aux output
> 
> mail# ps -aux
> USER       PID %CPU %MEM   VSZ   RSS  TT  STAT STARTED      TIME COMMAND
> vscan      482  0.0  0.0 46472     0  ??  IW   -         0:00.00 amavisd (virgin child) (perl5.8.8)
> vscan      483  0.0  0.0 46472     0  ??  IW   -         0:00.00 amavisd (virgin child) (perl5.8.8)

You have a bunch of amavisd processes that are completely swapped out
(0 RSS) and have never consumed any CPU (TIME column).  This probably
means that you could safely reduce the number of worker processes since
they're never used.

Also, the MailScanner process is pretty big; maybe there are some
settings you can change to make it use less.

-- 
	Dan Nelson
	dnelson at allantgroup.com