Re: Problem with spamd
Am 09.11.2006 um 20:35 schrieb Daryl C. W. O'Shea: Charlie Clark wrote: Am 09.11.2006 um 19:27 schrieb Daryl C. W. O'Shea: If your one and only child is busy doing an expire it can't scan messages too. ah, so I could increase the number of children running to do this? You could, running at least 2 children if you've got the resources to do it isn't a bad idea), but it sounds like you've either got a lot of individual bayes databases to expire or the expiry of one or more of the databases is never being allowed to complete. I think I have the resources for more children. It's not a lot of mail going through the system but I think the network connection often seems to have problems. You're best off disabling auto expire and doing it manually. I ran it manually and it only took a couple of seconds so I think that now that the performance issue has gone, this will hopefully eventually go away. Disable bayes_auto_expire in your local.cf and run an expire manually (and then set it up as a cron job) by running sa-learn -- force-expire as the user that SA normally runs as (if SA runs as more than one user, run it for all the users it runs as). It's probably going to take a considerable amount of time for it to run... let it finish, it will eventually. bayes_auto-expire isn't actually in my local.cf so I've added it as bayes_auto-expire 0 Yeah, it's on by default, that's how you disable it. It also strikes me that I can probably enable trusting the localhost on this machine - does this mean that spamassassin will not bother checking e-mail sent via the local SMTP? That's not at all what it means. If you need help configuring your that search the archives or start another thread. Got it sussed now all I need to do is tell Exim to unfreeze it's queue... Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Re: Problem with spamd
Charlie Clark wrote: Am 09.11.2006 um 19:27 schrieb Daryl C. W. O'Shea: If your one and only child is busy doing an expire it can't scan messages too. ah, so I could increase the number of children running to do this? You could, running at least 2 children if you've got the resources to do it isn't a bad idea), but it sounds like you've either got a lot of individual bayes databases to expire or the expiry of one or more of the databases is never being allowed to complete. You're best off disabling auto expire and doing it manually. The strange thing is these errors never occurred before last week and having just upgraded to 3.1.7 I would hope to have a system including all relevant bug fixes. Of course, as Theo said it might simply be easier to stop using spamd and just call spamassassin but it might also be helpful to track down the problem. Should I jump on the back of the old bug or make a new submission? Have you actually looked into making sure that you're not experiencing an expiry issue (like the expiry being times out and never completed) like Theo inferred you do off the bat? No, and I'll admit to not really understanding exactly what you mean. Where can I check and if necessary change this? Disable bayes_auto_expire in your local.cf and run an expire manually (and then set it up as a cron job) by running sa-learn --force-expire as the user that SA normally runs as (if SA runs as more than one user, run it for all the users it runs as). It's probably going to take a considerable amount of time for it to run... let it finish, it will eventually. bayes_auto-expire isn't actually in my local.cf so I've added it as bayes_auto-expire 0 Yeah, it's on by default, that's how you disable it. It also strikes me that I can probably enable trusting the localhost on this machine - does this mean that spamassassin will not bother checking e-mail sent via the local SMTP? That's not at all what it means. If you need help configuring your that search the archives or start another thread. Daryl
Re: Problem with spamd
Am 09.11.2006 um 19:27 schrieb Daryl C. W. O'Shea: If your one and only child is busy doing an expire it can't scan messages too. ah, so I could increase the number of children running to do this? The strange thing is these errors never occurred before last week and having just upgraded to 3.1.7 I would hope to have a system including all relevant bug fixes. Of course, as Theo said it might simply be easier to stop using spamd and just call spamassassin but it might also be helpful to track down the problem. Should I jump on the back of the old bug or make a new submission? Have you actually looked into making sure that you're not experiencing an expiry issue (like the expiry being times out and never completed) like Theo inferred you do off the bat? No, and I'll admit to not really understanding exactly what you mean. Where can I check and if necessary change this? Disable bayes_auto_expire in your local.cf and run an expire manually (and then set it up as a cron job) by running sa-learn -- force-expire as the user that SA normally runs as (if SA runs as more than one user, run it for all the users it runs as). It's probably going to take a considerable amount of time for it to run... let it finish, it will eventually. bayes_auto-expire isn't actually in my local.cf so I've added it as bayes_auto-expire 0 It also strikes me that I can probably enable trusting the localhost on this machine - does this mean that spamassassin will not bother checking e-mail sent via the local SMTP? Thank you very much for your help! Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Re: Problem with spamd
Charlie Clark wrote: Am 09.11.2006 um 02:10 schrieb Daryl C. W. O'Shea: Charlie Clark wrote: Looks like I'm on top of the resources problem but I am getting "421 delivery errors" even though the e-mails are coming through. This looks very similar to bug 3828 (which is Spamassassin + Exim). Except this bug should have been closed a long time ago. Without looking at the bug, it sounds like you're saying that Exim temp fails messages when a filter (SA) isn't available to filter the message in time. If that's the case it's sensible for that to happen. Indeed it is. I just don't understand why it is happening on this machine which has a very low load. If your one and only child is busy doing an expire it can't scan messages too. The strange thing is these errors never occurred before last week and having just upgraded to 3.1.7 I would hope to have a system including all relevant bug fixes. Of course, as Theo said it might simply be easier to stop using spamd and just call spamassassin but it might also be helpful to track down the problem. Should I jump on the back of the old bug or make a new submission? Have you actually looked into making sure that you're not experiencing an expiry issue (like the expiry being times out and never completed) like Theo inferred you do off the bat? No, and I'll admit to not really understanding exactly what you mean. Where can I check and if necessary change this? Disable bayes_auto_expire in your local.cf and run an expire manually (and then set it up as a cron job) by running sa-learn --force-expire as the user that SA normally runs as (if SA runs as more than one user, run it for all the users it runs as). It's probably going to take a considerable amount of time for it to run... let it finish, it will eventually. Daryl
Re: Problem with spamd
Am 09.11.2006 um 02:10 schrieb Daryl C. W. O'Shea: Charlie Clark wrote: Looks like I'm on top of the resources problem but I am getting "421 delivery errors" even though the e-mails are coming through. This looks very similar to bug 3828 (which is Spamassassin + Exim). Except this bug should have been closed a long time ago. Without looking at the bug, it sounds like you're saying that Exim temp fails messages when a filter (SA) isn't available to filter the message in time. If that's the case it's sensible for that to happen. Indeed it is. I just don't understand why it is happening on this machine which has a very low load. The strange thing is these errors never occurred before last week and having just upgraded to 3.1.7 I would hope to have a system including all relevant bug fixes. Of course, as Theo said it might simply be easier to stop using spamd and just call spamassassin but it might also be helpful to track down the problem. Should I jump on the back of the old bug or make a new submission? Have you actually looked into making sure that you're not experiencing an expiry issue (like the expiry being times out and never completed) like Theo inferred you do off the bat? No, and I'll admit to not really understanding exactly what you mean. Where can I check and if necessary change this? Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Re: Problem with spamd
Charlie Clark wrote: Looks like I'm on top of the resources problem but I am getting "421 delivery errors" even though the e-mails are coming through. This looks very similar to bug 3828 (which is Spamassassin + Exim). Except this bug should have been closed a long time ago. Without looking at the bug, it sounds like you're saying that Exim temp fails messages when a filter (SA) isn't available to filter the message in time. If that's the case it's sensible for that to happen. The strange thing is these errors never occurred before last week and having just upgraded to 3.1.7 I would hope to have a system including all relevant bug fixes. Of course, as Theo said it might simply be easier to stop using spamd and just call spamassassin but it might also be helpful to track down the problem. Should I jump on the back of the old bug or make a new submission? Have you actually looked into making sure that you're not experiencing an expiry issue (like the expiry being times out and never completed) like Theo inferred you do off the bat? Daryl
Re: Problem with spamd
Am 08.11.2006 um 23:00 schrieb Charlie Clark: Am 08.11.2006 um 22:45 schrieb Theo Van Dinter: On Wed, Nov 08, 2006 at 10:18:53PM +0100, Charlie Clark wrote: How many email to you received by day? (or by minute???) Excluding spam it's probably less than 50 per day for all accounts on this server! So there shouldn't ever be a problem. I *think* that the changes I've made today including restarting Exim seem to be working. If you only receive 2-3 messages per hour, just run "spamassassin" and don't bother with spamc/spamd. Why have another daemon? I didn't set this up originally and I generally try and follow the rule of messing with the system as little as possible as it is. That said I've extended the local.cf file which had virtually no directives and am in the process of upgrading from 3.0.3 to 3.1.7. I'm not pleased with my ISP for taking over a week to investigate the initial complaint and me actually using the trouble ticket to annotate the changes I make! Looks like I'm on top of the resources problem but I am getting "421 delivery errors" even though the e-mails are coming through. This looks very similar to bug 3828 (which is Spamassassin + Exim). Except this bug should have been closed a long time ago. The strange thing is these errors never occurred before last week and having just upgraded to 3.1.7 I would hope to have a system including all relevant bug fixes. Of course, as Theo said it might simply be easier to stop using spamd and just call spamassassin but it might also be helpful to track down the problem. Should I jump on the back of the old bug or make a new submission? Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Re: Problem with spamd
Am 08.11.2006 um 22:45 schrieb Theo Van Dinter: On Wed, Nov 08, 2006 at 10:18:53PM +0100, Charlie Clark wrote: How many email to you received by day? (or by minute???) Excluding spam it's probably less than 50 per day for all accounts on this server! So there shouldn't ever be a problem. I *think* that the changes I've made today including restarting Exim seem to be working. If you only receive 2-3 messages per hour, just run "spamassassin" and don't bother with spamc/spamd. Why have another daemon? I didn't set this up originally and I generally try and follow the rule of messing with the system as little as possible as it is. That said I've extended the local.cf file which had virtually no directives and am in the process of upgrading from 3.0.3 to 3.1.7. I'm not pleased with my ISP for taking over a week to investigate the initial complaint and me actually using the trouble ticket to annotate the changes I make! Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Re: Problem with spamd
On Wed, Nov 08, 2006 at 10:18:53PM +0100, Charlie Clark wrote: > >How many email to you received by day? (or by minute???) > > Excluding spam it's probably less than 50 per day for all accounts on > this server! So there shouldn't ever be a problem. I *think* that the > changes I've made today including restarting Exim seem to be working. If you only receive 2-3 messages per hour, just run "spamassassin" and don't bother with spamc/spamd. Why have another daemon? -- Randomly Selected Tagline: "The random quantum fluctuations of my brain are historical accidents that happen to have decided that the concepts of dynamic scoping and lexical scoping are orthogonal and should remain that way." - Larry Wall pgpUZK3L41Ypw.pgp Description: PGP signature
Re: Problem with spamd
Am 08.11.2006 um 20:51 schrieb François Rousseau: "max-children (set to 1 in this case)." Why 1??? That's the default for servers run by this ISP. Do you have a suggestion? How many email to you received by day? (or by minute???) Excluding spam it's probably less than 50 per day for all accounts on this server! So there shouldn't ever be a problem. I *think* that the changes I've made today including restarting Exim seem to be working. The problem may have been related to one account getting full and not accepting any new mail but I don't find this particularly convincing for the mail server running out of resources, Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Re: Problem with spamd
"max-children (set to 1 in this case)."Why 1???How many email to you received by day? (or by minute???)Francois Rousseau2006/11/8, Charlie Clark < [EMAIL PROTECTED]>:Am 08.11.2006 um 18:43 schrieb Theo Van Dinter: > On Wed, Nov 08, 2006 at 06:38:19PM +0100, Charlie Clark wrote:>> 2006-11-08 17:31:00 [9733] i: debug: refresh: 9733 refresh /home/>> confixx/web1p2/.spamassassin/bayes.lock Is this standard behaviour? It seemed okay when the lock is acquired >> but seems to spend most of its time actually refreshing the lock.>> It's ok if it's doing something to the DB, you want the lock> refreshed. I'm> guessing you're seeing a bayes expiry. Okay, seems to have calmed down now. i wonder if that's related tothe fact that I seem to be having problems sending e-mail:The address to which the message has not yet been delivered is: [EMAIL PROTECTED] Delay reason: Connection timed outPresumably because my buffers have been filled. I'v restarted Exim inthe hope that will help but I wonder what's causing this in the firstplace - what is screwing my SMTP server? It really doesn't look like it should be that busy but I don't really know where I should belooking!Charlie--Charlie ClarkHelmholtzstr. 20DüsseldorfD- 40215Tel: +49-211-938-5360GSM: +49-178-782-6226
Re: Problem with spamd
Am 08.11.2006 um 18:43 schrieb Theo Van Dinter: On Wed, Nov 08, 2006 at 06:38:19PM +0100, Charlie Clark wrote: 2006-11-08 17:31:00 [9733] i: debug: refresh: 9733 refresh /home/ confixx/web1p2/.spamassassin/bayes.lock Is this standard behaviour? It seemed okay when the lock is acquired but seems to spend most of its time actually refreshing the lock. It's ok if it's doing something to the DB, you want the lock refreshed. I'm guessing you're seeing a bayes expiry. Okay, seems to have calmed down now. i wonder if that's related to the fact that I seem to be having problems sending e-mail: The address to which the message has not yet been delivered is: [EMAIL PROTECTED] Delay reason: Connection timed out Presumably because my buffers have been filled. I'v restarted Exim in the hope that will help but I wonder what's causing this in the first place - what is screwing my SMTP server? It really doesn't look like it should be that busy but I don't really know where I should be looking! Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Re: Problem with spamd
On Wed, Nov 08, 2006 at 06:38:19PM +0100, Charlie Clark wrote: > 2006-11-08 17:31:00 [9733] i: debug: refresh: 9733 refresh /home/ > confixx/web1p2/.spamassassin/bayes.lock > > Is this standard behaviour? It seemed okay when the lock is acquired > but seems to spend most of its time actually refreshing the lock. It's ok if it's doing something to the DB, you want the lock refreshed. I'm guessing you're seeing a bayes expiry. -- Randomly Selected Tagline: "Sorry, not tonight. I have to floss my cat." - Random Turn-down line pgpkj6C9d2UZJ.pgp Description: PGP signature
Re: Problem with spamd
Am 08.11.2006 um 14:05 schrieb Charlie Clark: Is it possible to get more information from spamd about why it's taking so long? Thanks for any help. Okay, I have managed to get logging and debugging enabled --syslog file -- debug which will put debugging information in /spamd.log It seems to do an awful lot of locking 2006-11-08 17:31:00 [9733] i: debug: refresh: 9733 refresh /home/ confixx/web1p2/.spamassassin/bayes.lock Is this standard behaviour? It seemed okay when the lock is acquired but seems to spend most of its time actually refreshing the lock. What else should I be looking for to see where things are being held up? Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Problem with spamd
Hi, about a week ago my server started experiencing load problems and eventually closed all connections. It is running at an ISP and has lots of software preconfigured including spam assassin configured by the ISP. There are currently two problems: spamd is nearly monopolising the CPU but also the tcprcvbuf eventually get used up; but I suspect the two are related. As I did not configure the system I am have to working my way through but it looks like a default install. I could not find anything on the FAQ relating to this specifically apart from the reference to max-children (set to 1 in this case). It doesn't look like there are a lot of e-mails to process. The setup is Debian with spamd being called by as an Exim transport. These are the active rules vs171127:/usr/share/spamassassin# ls -l total 552 -rw-r--r-- 1 root root 6013 Jun 30 2005 10_misc.cf -rw-r--r-- 1 root root 1600 Jun 30 2005 20_anti_ratware.cf -rw-r--r-- 1 root root 8193 Jun 30 2005 20_body_tests.cf -rw-r--r-- 1 root root 1608 Jun 30 2005 20_compensate.cf -rw-r--r-- 1 root root 12078 Jun 30 2005 20_dnsbl_tests.cf -rw-r--r-- 1 root root 15695 Jun 30 2005 20_drugs.cf -rw-r--r-- 1 root root 11263 Jun 30 2005 20_fake_helo_tests.cf -rw-r--r-- 1 root root 27706 Jun 30 2005 20_head_tests.cf -rw-r--r-- 1 root root 15482 Jun 30 2005 20_html_tests.cf -rw-r--r-- 1 root root 10934 Jun 30 2005 20_meta_tests.cf -rw-r--r-- 1 root root 22094 Jun 30 2005 20_phrases.cf -rw-r--r-- 1 root root 4961 Jun 30 2005 20_porn.cf -rw-r--r-- 1 root root 14134 Jun 30 2005 20_ratware.cf -rw-r--r-- 1 root root 5027 Jun 30 2005 20_uri_tests.cf -rw-r--r-- 1 root root 2329 Jun 30 2005 23_bayes.cf -rw-r--r-- 1 root root 9112 Jun 30 2005 25_body_tests_es.cf -rw-r--r-- 1 root root 2733 Jun 30 2005 25_hashcash.cf -rw-r--r-- 1 root root 2299 Jun 30 2005 25_spf.cf -rw-r--r-- 1 root root 4698 Jun 30 2005 25_uribl.cf -rw-r--r-- 1 root root 52288 Jun 30 2005 30_text_de.cf -rw-r--r-- 1 root root 40677 Jun 30 2005 30_text_fr.cf -rw-r--r-- 1 root root 57934 Jun 30 2005 30_text_nl.cf -rw-r--r-- 1 root root 34798 Jun 30 2005 30_text_pl.cf -rw-r--r-- 1 root root 29369 Jun 30 2005 50_scores.cf -rw-r--r-- 1 root root 6882 Jun 30 2005 60_whitelist.cf -rw-r--r-- 1 root root939 Jun 30 2005 65_debian.cf -rw-r--r-- 1 root root 101479 Jun 30 2005 languages -rw-r--r-- 1 root root 18944 Jun 30 2005 triplets.txt -rw-r--r-- 1 root root 1531 Jun 30 2005 user_prefs.template This is from top: 3796 web1p239 15 46764 42m 4252 R 65.2 0.7 144:06.98 spamd and this is a check of the tcprc use tcprcvbuf481548189607218840243681759 148967 (machine was rebooted this morning) Is it possible to get more information from spamd about why it's taking so long? Thanks for any help. Charlie -- Charlie Clark Helmholtzstr. 20 Düsseldorf D- 40215 Tel: +49-211-938-5360 GSM: +49-178-782-6226
Problem with spamd not restarting after rulesdujour updates SARE stock
I'm having a problem with spamd not restarting after a rule update. I have noticed it fails to restart via RulesDuJour after the SARE Stocks Ruleset is changed (every time) and occasionally on others. I was wondering if anyone else is having the problem? Here is the update notice I get: SARE Stocks Ruleset) has changed on serverupdated. Version line: # Version: 01.00.16 I've added a cron job to stop and start spamd and as you can see from the report spamd was not running when the cron job kicked in. Shutting down postfix: [ OK ] Shutting down spamd: spamd: no process killed Starting spamd: Starting postfix: [ OK ] = Kevin W. Gagel Network Administrator Information Technology Services (250) 562-2131 local 448 My Blog: http://mail.cnc.bc.ca/blogs/gagel --- The College of New Caledonia, Visit us at http://www.cnc.bc.ca Virus scanning is done on all incoming and outgoing email. Anti-spam information for CNC can be found at http://avas.cnc.bc.ca ---
Re: Problem with spamd
Michael Parker wrote:
By the way, before anyone asks, I have the following in my exim.conf
having been bitten by large emails before, so it's not that:
accept condition = ${if >{$message_size}{500k}{yes}{no}}
That's been working fine until this email started coming through.
500k might still be too big, depending on the message, the default for
spamc is 250k. What size is the actual message that is causing the
problem? If it appears much smaller, please open a bug and attach a
copy of the message.
That's part of the problem, how can I get to the message? I'm using
Exim and Exim doesn't accept the message (in to it's spool) until spamd
completes it. If spamd hangs, where can I find a copy of the message(s)
it's working on?
I'll reduce it to 250k for now.
Cheers,
Andy
--
Andrew Jeffries
NextGen Development Ltd
"Pushing the boundaries of internet interactivity"
Tel : 0870 170 5902
Fax : 0709 223 8820
Web : http://www.nextgendevelopment.co.uk
Email : [EMAIL PROTECTED]
Re: Problem with spamd
Andrew Jeffries wrote:
> Andrew Jeffries wrote:
>> I'm running spamassassin 3.1.0 as spamd with the following command line
>> options:
>>
>> -m 5 --max-conn-per-child=5 -u mail --ident-timeout=30 -s
>> /var/log/spamd.log -D --round-robin
>>
>> When I receive a certain email (or a few from the same top level domain)
>> it hangs spamassassin as it tries to allocate a boatload of memory
>> (excerpt from top, this is a 512MB machine):
>>
>>PID USER PR NI VIRT RES SHR S %CPU %MEMTIME+ COMMAND
>> 6076 mail 18 0 876m 452m 660 R 7.3 91.4 0:22.34 spamd
>
> By the way, before anyone asks, I have the following in my exim.conf
> having been bitten by large emails before, so it's not that:
>
> accept condition = ${if >{$message_size}{500k}{yes}{no}}
>
> That's been working fine until this email started coming through.
500k might still be too big, depending on the message, the default for
spamc is 250k. What size is the actual message that is causing the
problem? If it appears much smaller, please open a bug and attach a
copy of the message.
Thanks
Michael
signature.asc
Description: OpenPGP digital signature
Re: Problem with spamd
Andrew Jeffries wrote:
I'm running spamassassin 3.1.0 as spamd with the following command line
options:
-m 5 --max-conn-per-child=5 -u mail --ident-timeout=30 -s
/var/log/spamd.log -D --round-robin
When I receive a certain email (or a few from the same top level domain)
it hangs spamassassin as it tries to allocate a boatload of memory
(excerpt from top, this is a 512MB machine):
PID USER PR NI VIRT RES SHR S %CPU %MEMTIME+ COMMAND
6076 mail 18 0 876m 452m 660 R 7.3 91.4 0:22.34 spamd
By the way, before anyone asks, I have the following in my exim.conf
having been bitten by large emails before, so it's not that:
accept condition = ${if >{$message_size}{500k}{yes}{no}}
That's been working fine until this email started coming through.
Cheers,
--
Andrew Jeffries
NextGen Development Ltd
"Pushing the boundaries of internet interactivity"
Tel : 0870 170 5902
Fax : 0709 223 8820
Web : http://www.nextgendevelopment.co.uk
Email : [EMAIL PROTECTED]
Problem with spamd
Hi everyone, I'm running spamassassin 3.1.0 as spamd with the following command line options: -m 5 --max-conn-per-child=5 -u mail --ident-timeout=30 -s /var/log/spamd.log -D --round-robin When I receive a certain email (or a few from the same top level domain) it hangs spamassassin as it tries to allocate a boatload of memory (excerpt from top, this is a 512MB machine): PID USER PR NI VIRT RES SHR S %CPU %MEMTIME+ COMMAND 6076 mail 18 0 876m 452m 660 R 7.3 91.4 0:22.34 spamd Consistently the last few lines in the debug log before I have to kill it are: Tue Dec 13 12:02:29 2005 [6076] dbg: uri: html uri found, http://80.179.153.114/cgi-bin/SPA/[EMAIL PROTECTED] Tue Dec 13 12:02:29 2005 [6076] dbg: uri: cleaned html uri, http://80.179.153.114/cgi-bin/SPA/[EMAIL PROTECTED] Tue Dec 13 12:02:29 2005 [6076] dbg: uri: html domain, 80.179.153.114 For now, I've hopefully managed to keep my server running by putting the following in my exim.conf: deny message = Emails from .il are expressly rejected due to _ mailbombing senders = *.il deny message = Emails from .il are expressly rejected due to _ mailbombing hosts = *.il The full excerpt of the log file is attached. I'll happily upload the file it refers to somewhere if it helps, the content seems to be an HTML header followed by GIF data. If I extract the GIF data portion it seems to be a valid (displayable) GIF, but I can't guarantee it's not a hacking attempt. Let me know what further information I can provide or if there's a better way of trapping this. Cheers, Andy -- Andrew Jeffries NextGen Development Ltd "Pushing the boundaries of internet interactivity" Tel : 0870 170 5902 Fax : 0709 223 8820 Web : http://www.nextgendevelopment.co.uk Email : [EMAIL PROTECTED] Tue Dec 13 12:00:30 2005 [6073] info: prefork: child states: II Tue Dec 13 12:00:30 2005 [6133] dbg: prefork: sysread(8) not ready, wait max 300 secs Tue Dec 13 12:02:28 2005 [6133] dbg: prefork: periodic ping from spamd parent Tue Dec 13 12:02:28 2005 [6133] dbg: prefork: sysread(8) not ready, wait max 300 secs Tue Dec 13 12:02:28 2005 [6076] dbg: prefork: periodic ping from spamd parent Tue Dec 13 12:02:28 2005 [6076] dbg: prefork: sysread(8) not ready, wait max 300 secs Tue Dec 13 12:02:28 2005 [6073] dbg: prefork: ordered 6076 to accept Tue Dec 13 12:02:28 2005 [6073] dbg: prefork: sysread(7) not ready, wait max 300 secs Tue Dec 13 12:02:28 2005 [6076] info: spamd: connection from localhost [127.0.0.1] at port 44765 Tue Dec 13 12:02:28 2005 [6073] dbg: prefork: child 6076: entering state 2 Tue Dec 13 12:02:28 2005 [6073] dbg: prefork: new lowest idle kid: 6133 Tue Dec 13 12:02:28 2005 [6076] dbg: config: read_scoreonly_config: cannot open "//.spamassassin/user_prefs": No such file or directory Tue Dec 13 12:02:28 2005 [6076] dbg: info: user has changed Tue Dec 13 12:02:28 2005 [6076] error: mkdir /.spamassassin: Permission denied at /usr/lib/perl5/vendor_perl/5.8.6/Mail/SpamAssassin.pm line 1467 Tue Dec 13 12:02:28 2005 [6076] dbg: config: mkdir /.spamassassin failed: mkdir /.spamassassin: Permission denied at /usr/lib/perl5/vendor_perl/5.8.6/Mail/SpamAssassin.pm line 1467 Tue Dec 13 12:02:28 2005 [6076] dbg: config: Tue Dec 13 12:02:28 2005 [6076] dbg: bayes: no dbs present, cannot tie DB R/O: /.spamassassin/bayes_toks Tue Dec 13 12:02:28 2005 [6076] dbg: config: score set 1 chosen. Tue Dec 13 12:02:28 2005 [6076] info: spamd: checking message <[EMAIL PROTECTED]> for nobody:8 Tue Dec 13 12:02:28 2005 [6076] dbg: dns: name server: 80.68.80.24, family: 2, ipv6: 0 Tue Dec 13 12:02:28 2005 [6076] dbg: bayes: no dbs present, cannot tie DB R/O: /.spamassassin/bayes_toks Tue Dec 13 12:02:28 2005 [6076] dbg: received-header: parsed as [ ip=80.179.153.114 rdns=80.179.153.114.static.012.net.il helo=imesh.co.il by=server1.nextgendevelopment.co.uk ident= envfrom= intl=0 id=1Em8rQ-0001b0-OV auth= ] Tue Dec 13 12:02:28 2005 [6076] dbg: dns: looking up A records for 'server1.nextgendevelopment.co.uk' Tue Dec 13 12:02:28 2005 [6076] dbg: dns: A records for 'server1.nextgendevelopment.co.uk': 80.68.80.217 Tue Dec 13 12:02:28 2005 [6076] dbg: dns: looking up A records for 'server1.nextgendevelopment.co.uk' Tue Dec 13 12:02:28 2005 [6076] dbg: dns: A records for 'server1.nextgendevelopment.co.uk': 80.68.80.217 Tue Dec 13 12:02:28 2005 [6076] dbg: received-header: 'by' server1.nextgendevelopment.co.uk has public IP 80.68.80.217 Tue Dec 13 12:02:28 2005 [6076] dbg: received-header: relay 80.179.153.114 trusted? no internal? no Tue Dec 13 12:02:28 2005 [6076] dbg: received-header: parsed as [ ip=127.0.0.1 rdns=counter helo=imesh.co.il by=imesh.co.il ident= envfrom= intl=0 id=jBD3TUeP024718 auth= ] Tue Dec 13 12:02:28 2005 [6076] dbg: received-header: relay 127.0.0.1 trusted? no internal? no Tue Dec 13 12:02:28 2005 [6076] dbg: metadata: X-Spam-Relays-Trusted: Tue Dec 13 12:02:28 2005 [6076] dbg: metadata: X-Spam-Relays-Untrusted: [ ip=80.179.153
strange problem with spamd on a suse 8.0
Hi, i've been running spamassassin sucessfully on a suse 8.0 with postfix and cyrus-imap for quite a while, but ever so often i hit the following snag: after a reboot, spamd wouldnt start. the init script i'm using: <-- cut --> #! /bin/sh # Copyright (c) 1995-2002 SuSE Linux AG, Nuernberg, Germany. # All rights reserved. # # Author: Kurt Garloff <[EMAIL PROTECTED]> # # /etc/init.d/spamd # # and symbolic its link # # /(usr/)sbin/rcspamd # # LSB compliant service control script; see http://www.linuxbase.org/spec/ # # System startup script for some example service or daemon spamd (template) # ### BEGIN INIT INFO # Provides: spamd # Required-Start: $remote_fs $syslog cyrus # Required-Stop: $remote_fs $syslog cyrus # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Description:Start spamd to allow XY and provide YZ # continued on second line by '#' ### END INIT INFO # # Note on Required-Start: It does specify the init script ordering, # not real dependencies. Depencies have to be handled by admin # resp. the configuration tools (s)he uses. # Source SuSE config (if still necessary, most info has been moved) test -r /etc/rc.config && . /etc/rc.config # Check for missing binaries (stale symlinks should not happen) spamd_BIN=/usr/sbin/spamd test -x $spamd_BIN || exit 5 # Check for existence of needed config file and read it #spamd_CONFIG=/etc/sysconfig/spamd #test -r $spamd_CONFIG || exit 6 #. $spamd_CONFIG # Shell functions sourced from /etc/rc.status: # rc_check check and set local and overall rc status # rc_statuscheck and set local and overall rc status # rc_status -v ditto but be verbose in local rc status # rc_status -v -r ditto and clear the local rc status # rc_failedset local and overall rc status to failed # rc_failed set local and overall rc status to # rc_reset clear local rc status (overall remains) # rc_exit exit appropriate to overall rc status # rc_activechecks whether a service is activated by symlinks . /etc/rc.status # First reset status of this service rc_reset # Return values acc. to LSB for all commands but status: # 0 - success # 1 - generic or unspecified error # 2 - invalid or excess argument(s) # 3 - unimplemented feature (e.g. "reload") # 4 - insufficient privilege # 5 - program is not installed # 6 - program is not configured # 7 - program is not running # # Note that starting an already running service, stopping # or restarting a not-running service as well as the restart # with force-reload (in case signalling is not supported) are # considered a success. case "$1" in start) echo -n "Starting spamd" ## Start daemon with startproc(8). If this fails ## the echo return value is set appropriate. # NOTE: startproc returns 0, even if service is # already running to match LSB spec. startproc $spamd_BIN -q -d -x #--virtual-config-dir=/var/spool/spamassassin # Remember status and be verbose rc_status -v ;; stop) echo -n "Shutting down spamd" ## Stop daemon with killproc(8) and if this fails ## set echo the echo return value. /usr/bin/killall -TERM spamd # Remember status and be verbose rc_status -v ;; try-restart) ## Stop the service and if this succeeds (i.e. the ## service was running before), start it again. ## Note: try-restart is not (yet) part of LSB (as of 0.7.5) $0 status >/dev/null && $0 restart # Remember status and be quiet rc_status ;; restart) ## Stop the service and regardless of whether it was ## running or not, start it again. $0 stop $0 start # Remember status and be quiet rc_status ;; force-reload) ## Signal the daemon to reload its config. Most daemons ## do this on signal 1 (SIGHUP). ## If it does not support it, restart. echo -n "Reload service spamd" ## if it supports it: killall -HUP spamd touch /var/run/spamd.pid rc_status -v ## Otherwise: #$0 stop && $0 start #rc_status ;; reload) ## Like force-reload, but if daemon does not support ## signalling, do nothing (!) # If it supports signalling: echo -n "Reload service spamd" killall -HUP spamd touch /var/run/spamd.pid rc_status -v ## Otherwise if it does not support reload: #rc_failed 3 #rc_status -v ;; status) echo -n "Checking for service spamd: " ## Check status with checkproc(8), if process is running ## checkproc will return with exit status 0. # Return value is slightly different for the status command: # 0 - service running # 1 - service dead, but /var/run/ pid file exis
BIG problem with spamd
Hi! I'm running spamassasin 3.0.3 and my spamd freeze. This is my options: spamd -create-prefs --max-children 5 --helper-home-dir=/home/vpopmail -x -q -u vpopmail -D Ok. I have real system users in LDAP and virtual user in vpopmail. Well, I get that log lines: Sep 29 11:50:39 mercury spamd[28210]: logmsg: connection from localhost.localdomain [127.0.0.1] at port 57244 Sep 29 11:50:39 mercury spamd[28210]: connection from localhost.localdomain [127.0.0.1] at port 57244 Sep 29 11:50:39 mercury spamd[28210]: debug: Conf::SQL: executing SQL: SELECT preference, value FROM userpref WHERE username = '[EMAIL PROTECTED]' OR username = '@GLOBAL' OR username = 'domain' ORDER BY username ASC Sep 29 11:50:39 mercury spamd[28210]: debug: retrieving prefs for [EMAIL PROTECTED] from SQL server Sep 29 11:50:39 mercury spamd[28210]: debug: user has changed The spamd process has an established connection with ldap server but it does nothing. If i restart the ldap server spamd accept again mail from spamc and process all mail in the queue. What is the problem? Thank you. Rick
