I thought I would post a situation that I have, that shows something simmilar.

On a server that gets about 250k emails a day, we had no problem.  Then it started using 50% of the processor, then 100% (dual processor machine).

I looked everywhere to find the problem, including downgrading the version of Spam Filter we were using, same problem.

In the connection list, it would show a message processing.  It could stay there for a LONG time, perhaps 20 minutes.  During this time it could not handle the incoming messages and start backing up until the max connection limit is reached.

Eventually the connection would drop, and the server would return to normal operation.  A while later, it would happen again.  After watching it for a couple of days, it was always the same few emails... the sending server would keep retrying assuming it was not being delivered.

I eventually found the problem (sorta), it was due to the fact that I started using REGEX in the keyword filter list.  Some combination of my regex keywords, and these few emails caused Spam Filter to freak out.   I did not do any furhter testing, I just removed the few REGEX based keyword filters I was using and it has been fine ever since.

I'm including the REGEX filters I was using if anyone is interested.

(\bbad credit\b)
((mortage|mortage|finance)(.*?)rate)
(\bcialis\b)
(.*(refugee|orphan)(.*?)(killed)(.*?)(million))
(\brefi\b)
((?i)Subject:.*(mortag|mortgage)(.*?)(approv|rate))
((?i)Subject:.*chase(.*?)(account|bank))
((?i)Subject:.*(equity|refi)(.*?)(loan))
(otc(.*?)(stock|securities))
(.*(lott)(.*?)(won|win)(.*?)million)
(congratulations(.*?)you(.*?)won)
(\bsec filings\b)

So, the problem would happen on the same emails, perhaps 3 or 4 out of 250,000 so it is not easy to reproduce.  When it does happen, all hell breaks loose.  My main clue was the processing window of the task list that led me to find the problem.

Yeah... this is a bug.  If a database entry is not possible for whatever reason, Spamfilter will never release the connection.  We had our SQL server fail, which caused Spamfilter to keep every connection open indefinately.  This should probably be changed.

Richard,

I had sent logs to LogSat showing the same thing and believe that was one of the issues he addressed in the 555 build or ... it is still being addressed.  I also do not believe I have seen any since the 555 but have not looked today yet.