> vicinity), then Webalizer will (a) take a lot longer than usual and (b) > occupy a LOT of memory while running. > The same thing happens with the default Cobalt scripts; in my experience a > logfile over 100MB will easily cripple a RaQ4 with 256MB. > > Make sure they're (a) getting rotated, and (b) that something/someone/some > site is not experiencing unusually high hitrates. Yes, bit his loadavg was around 100. There were 100 processes waiting, eager to run. Unless there were a couple hundred separate instances of Webalizer going...
I think webalizer was at least part of the problem. Although I didn't see much suspicious activity in my maillog, I've finished updating my cgi scripts to close some potential spam holes. So far so good.
Webalizer spawns multiple Webasolver processes to do the reverse lookups -- but it usually seems to behave itself. One thing I hadn't done was to setup webalizer with a DNS cache. So it was taking about 3 hours to process all the logs and do the reverse lookups. I've just setup the dns cache and already on the second day it finished 15 minutes earlier -- probably evidence that it's using the cache and taking some load off the server.
Thanks for all the help. Brian