sudden peak in load average

[Bart Silverstrim]

Mark Tinguely wrote:
>>  Is it possible that there's a message in your queue that's *being 
>>  processed*, so it may have arrived earlier than near that time and 
>>  causes the spike?
> 
> Bart is correct that the SA processing occurs before sendmail log entry.
> 
> Lately, I have had problems with the latest spamass-milter. Occasionally,
> something is forking off another spamass-milter and the original one is
> in some tight loop eating processor time. I am not sure if it is the newer
> spamass-milter or the fact that I also added the dkim-milter into the mix.
> 
> FYI:
> I sent to the original questioner a crude C program to monitor his current
> loadaverage. This monitor will save the output of the command "ps -aux" to
> a timestamped temporary file when the current loadaverage exceeds a defined
> amount (15.0).

Another thing to look at would be the output of something like lsof, so 
that if it is spamassassin, maybe there's a possibility that it could be 
narrowed down to a particular temporary file unless there's another way 
to see if there's a particular message chewing away on SA's analysis?

It doesn't take a big message to skew SA asunder if it has the right bit 
of information in it...