Is it possible that there's a message in your queue that's *being
processed*, so it may have arrived earlier than near that time and
causes the spike?
Bart is correct that the SA processing occurs before sendmail log entry.
Lately, I have had problems with the latest spamass-milter. Occasionally,
something is forking off another spamass-milter and the original one is
in some tight loop eating processor time. I am not sure if it is the newer
spamass-milter or the fact that I also added the dkim-milter into the mix.
I sent to the original questioner a crude C program to monitor his current
loadaverage. This monitor will save the output of the command "ps -aux" to
a timestamped temporary file when the current loadaverage exceeds a defined
Another thing to look at would be the output of something like lsof, so
that if it is spamassassin, maybe there's a possibility that it could be
narrowed down to a particular temporary file unless there's another way
to see if there's a particular message chewing away on SA's analysis?
It doesn't take a big message to skew SA asunder if it has the right bit
of information in it...