It affects some versions of Plesk LINUX from 8.0.1
Symptoms:
------------
The load increases without apparent cause until reaching very exaggerated levels, causing the system to collapse. 100% of the CPU is used. "Load average" measurements above 100 are reached.
2.- Many "relaylock" processes are detected in the maillog analysis.
3.- We observe processes like the following:
/var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/Bin/cmd5checkpw /var/qmail/bin/true
Solution:
-----------
cd /var/qmail/control
ls -la
If the files dhparam512.pem and dhparam1024.pem appear, proceed as follows:
cp dhparam512.pem dhparam512.pem.copia (we make a copy just in case)
mv dhparam512.pem dh512.pem (we rename it)
cp dhparam1024.pem dhparam1024.pem.copia (we make a copy just in case)
mv dhparam1024.pem dh1024.pem (we rename it)
Now we restart qmail
service qmail restart
If the restart fails, we restart xinetd and then qmail:
service xinetd restart
service qmail restart
Once it has started correctly, check in the maillog (/usr/local/psa/var/log/mailllog) that the mail is working correctly. We will see that the system load has been considerably reduced.
Why?
-----------
The .pem files are the certificates used by qmail-smtpd for TLS sessions. Qmail tries to open them for each of the incoming connections. If they are not available, it generates them "on the fly", generating a very high CPU load (in fact, it can consume all the CPU even on systems with 4 processors and several GB of RAM).
Originally, the certificate files are "dh512.pem" and "dh1024.pem", but in some versions of Plesk they have been replaced by "dhparam512.pem" and "dhparam1024.pem", which are not identified by qmail as certificate files. By renaming them and restarting qmail, we solve the problem.