Subject: Lots of smap processes runnning

From: [email-masked]
Date: Mon, 7 Feb 2000 17:25:37 +0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

I've got smap/smapd (part of the TIS Firewall Toolkit at
http://www.fwtk.org) running as a wrapper for sendmail (v8.9.3) on a Solaris
2.6(sparc) box and there are LOTS of smap processes that have been around
for up to a few days.  Other mail servers are getting SMTP timeouts
connecting to my server, I think due to smap having too many connections
open and the kernel being unable to bind another smap tcp/ip connection.  I
am very new to smap and sendmail (inherited this job from someone else) so
am not entirely sure where to go from here.

I saw a patch for smap (http://www.fwtk.org/fwtk/patches/patches.html#2.2)
regarding reading an EOF instead of just a "." by itself as a valid
end-of-message and have noticed the /var/spool/mqueue directory that smap
writes to has many qf* files with just a "." at the end.

Could these things be related?  Has anyone got any ideas about what might be
causing smap processes to not die?

Any suggestions appreciated.  I will summarise any responses and post for
the information of others.

Regards,

Adrian Blount

Unix Administrator                  E-mail: [email-masked]
IMD Systems                         Phone : +61 8 9222 1117
Western Australia Police Service    Fax   : +61 8 9222 1698

---

From: Ted Keller <[email-masked]>
Date: Mon, 7 Feb 2000 08:29:51 -0500 (EST)

Adrian,

The smap timeout processing is a bit suspect at time.  It's been an area
that I re-implemented with a simpler process which seems to be much better
at finding and killing off old connections.

The issue is when the remote site goes away, sometimes smap can't detect
that - and hangs waiting for the completion of a read from that site.

Stock smap does have timeout processing included - but sometimes I think
that gets mixed up with sokeepalive and other tcp parameters.

Sesstions that are older than a few hours can certainly be killed off.
Some have implemented cron jobs to do this.

I've re-implemented the smap code - and in part - the timeout processing.
I can provide if you are interested.

ted keller - bfg.com