I've got PRM (Process Resource Monitor) on my server. Basically it monitors certain processes, and kills them if they exceed a certain limit.

Lately I've been getting qmail alerts. The latest this morning:

- Event Summary:
USER: qmaild
PID : 14375
CMD : /var/qmail/bin/qmail-smtpd
CPU%: 0 (limit: 45)
MEM%: 0 (limit: 20)
PROCS: 1067 (limit: 80

Now only around 4 or 5 users have active email accounts on the server (myself plus a few family members).

My understanding - correct me if I'm wrong - is the a qmail process is spawned for every incoming *and* outgoing email. Nobody was sending any outgoing emails of that magnitude, so the only possbilities left are if my server is sending spam or if a bunch if incoming emails are being processed. I do get a lot of spam to invalid addresses, so I turned off the bounced email replies since they were queueing up.

I've tried to search for qmail's log to see what's happening, but I can't find it. Perhaps its set not to log?

Interestingly, this has started to occur the day after I hired a (well-known) company to "secure" my server. Doing so resulted in several hours of down time, thnigs not done they should have, etc. I'm wondering if they've screwed up qmail somehow.

I did have one spam bounce in my remote queue that I looked at. I'm not sure why it was even there, since I've turned off spam bounce replies. But a couple of lines caught my interest:

<epiphany@domain.com>:
bin/qmail-local: error while loading shared libraries: libc.so.6: cannot open shared object file: Error 23

<cstevenson@domain.com>:
bin/qmail-local: error while loading shared libraries: /lib/libsafe.so.2: cannot open shared object file: Error 23

Neither of those two addresses exist. But why the qmail errors?

Any advice on tracking this down would be most appreciated.