Exim overload my server !

[PauGasol]

Hi,

I have a problem of very high load average in one box. I see a lot of pids about exim, sometimes with 99,9% of CPU use, and the load is more than 15 o 20 all time.

If i stop the exim the load is :

21:19:06 up 34 days, 8 min, 1 user, load average: 1.08, 3.88, 9.24
131 processes: 130 sleeping, 1 running, 0 zombie, 0 stopped
CPU0 states: 8.0% user 3.3% system 0.0% nice 0.0% iowait 88.0% idle
CPU1 states: 8.0% user 2.3% system 0.0% nice 0.0% iowait 89.0% idle
CPU2 states: 12.4% user 1.4% system 0.0% nice 0.0% iowait 85.0% idle
CPU3 states: 3.3% user 0.1% system 0.0% nice 0.0% iowait 96.0% idle
Mem: 2063892k av, 1782516k used, 281376k free, 0k shrd, 112596k buff
1067076k actv, 238984k in_d, 67268k in_c
Swap: 4144760k av, 481668k used, 3663092k free 981812k cached

A very good top , the machine has 300 domains with Zend Performance Suite . All ok, I will never understand the exim logs, even using Sawmill ! , the activity of log is fast and heavy.. a lot of mails from / to unexistens emails , rare domains as crystosoft.com , contoso.com , the sawmill has a avergage of 15.000 messages, and these days over 70.000 i cant understand why , i cant understand this logs , i blocked the mora activity rare ips but nothing.

Plz any idea what happend / any possible solution ?

Thanks

 

[PauGasol]

I analize the last log with Sawmill , (two days of log) from 19 Dic .

FROMS :

From Messages
1 [email protected] 27,594 47.8 %
2 [email protected] 7,241 12.6 %
3 [email protected] 2,927 5.1 %
4 [email protected] 1,803 3.1 %
5 [email protected] 1,280 2.2 %
6 [email protected] 958 1.7 %
.................. normal domains

TOS :

1 [email protected] 27,594 96.0 %
2 [email protected] 318 1.1 %
3 [email protected] 128 0.5 %
............... normal and local domains

all of this domains NOT resolve to the machine , can i block this things in the exim ?

I have the ip of the senders but i prefer other solution.. because new ips are added

Thanks