Re: Spamassassin Timeout error
On Fri, 2014-02-21 at 14:57 -0800, John Hardin wrote: > On Sat, 22 Feb 2014, parakrama55 . wrote: > > > 3 .Do you know how to change the timeout in the SA glue? > > No , please advice > > > > 4. What is your SA glue layer? > > > > Both exim and spamassin services runs in the same server , exim calls > > spamassin via 127.0.0.1 address > > This may help: > http://commons.oreilly.com/wiki/index.php/SpamAssassin/Integrating_SpamAssassin_with_Exim#Setting_a_timeout_on_spamc > I think that is a bit old; not sure if sa-Exim is still supported/maintained. This link may be more useful: http://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html Typically we limit the resources SA uses by message size (done by Exim), and set a timeout for SA (done by SA using 'time_limit' in our local.cf file). John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001
Re: Spamassassin Timeout error
On Fri, 2014-02-21 at 19:24 +0530, parakrama55 . wrote: > we are getting follwing errors in the logs, > > 2014-02-21 05:50:27 1WGqSi-0003d7-Pi spam acl condition: error reading > from spamd socket: Connection timed out > 2014-02-21 05:50:27 1WGqSi-0003dD-9p spam acl condition: error reading > from spamd socket: Connection timed out > Hello, We get quite a few of these on a couple of our old mail servers. They are overloaded systems, and so it takes too long to run SA. Exim cuts in in order for the message to actually be accepted within an overall 5 minute time limit. You might want to check the SA and exim logs to see what is going on, and run 'top' to see how busy the servers get. John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001
Re: Spamassassin Timeout error
On Sat, 22 Feb 2014, parakrama55 . wrote: 3 .Do you know how to change the timeout in the SA glue? No , please advice 4. What is your SA glue layer? Both exim and spamassin services runs in the same server , exim calls spamassin via 127.0.0.1 address This may help: http://commons.oreilly.com/wiki/index.php/SpamAssassin/Integrating_SpamAssassin_with_Exim#Setting_a_timeout_on_spamc If this is how SA is integrated into your exim, see if you can determine what the current spamc timeout is set to. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- Maxim VI: If violence wasn’t your last resort, you failed to resort to enough of it. --- Tomorrow: George Washington's 282nd Birthday
Re: Spamassassin Timeout error
On Sat, 22 Feb 2014, parakrama55 . wrote: Yes still getting timeouts I was just surprised that exim wasn't willing to wait 20sec for the scan to complete. using 4 CPUS Cpu0 : 73.5%us, 1.1%sy, 0.0%ni, 22.0%id, 1.6%wa, 0.1%hi, 1.8%si, 0.0%st Cpu1 : 70.6%us, 1.0%sy, 0.0%ni, 23.9%id, 1.2%wa, 0.0%hi, 3.3%si, 0.0%st Cpu2 : 70.4%us, 0.8%sy, 0.0%ni, 24.3%id, 1.1%wa, 0.0%hi, 3.4%si, 0.0%st Cpu3 : 69.9%us, 0.8%sy, 0.0%ni, 24.9%id, 1.0%wa, 0.0%hi, 3.4%si, 0.0%st OK, it looks like you're fairly well-provisioned there. What version of SA is this? Do you have any local rules defined, or any third-party rules? Or just the stock rules? How recently were your stock rules updated? Do you know how to run spamassassin against a single message in debug mode? On 22 February 2014 04:09, John Hardin wrote: On Sat, 22 Feb 2014, parakrama55 . wrote: Spmd parameters == ps aux | grep spamd root 6679 0.3 1.3 130064 66940 ?Ss 13:45 0:07 /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid 102 8747 82.5 1.4 136320 73632 ?R14:22 2:23 spamd child nobody8754 85.8 1.4 136228 73600 ?R14:22 2:23 spamd child nobody8772 87.6 1.4 135980 73388 ?R14:22 2:07 spamd child 102 8814 84.2 1.4 136052 73368 ?D14:23 1:41 spamd child root 8979 0.0 0.0 6032 720 pts/0S+ 14:25 0:00 grep spamd 2. Can you check your SA logs and see what the average scan times look like? Scan time varis beteen 1 - 20 seconds Yet exim times out? 3 .Do you know how to change the timeout in the SA glue? No , please advice I'm not familiar with exim, sorry. 4. What is your SA glue layer? Both exim and spamassin services runs in the same server , exim calls spamassin via 127.0.0.1 address 5. What hardware is devoted to SA? Is it perhaps overloaded? Its runs on vmware server I see 5GB RAM in the earlier mail, and no swap in use, so you appear OK for RAM. How many CPUs does the VM have assigned? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- Maxim VI: If violence wasn’t your last resort, you failed to resort to enough of it. --- Tomorrow: George Washington's 282nd Birthday
Re: Spamassassin Timeout error
Hi.. Yes still getting timeouts using 4 CPUS Cpu0 : 73.5%us, 1.1%sy, 0.0%ni, 22.0%id, 1.6%wa, 0.1%hi, 1.8%si, 0.0%st Cpu1 : 70.6%us, 1.0%sy, 0.0%ni, 23.9%id, 1.2%wa, 0.0%hi, 3.3%si, 0.0%st Cpu2 : 70.4%us, 0.8%sy, 0.0%ni, 24.3%id, 1.1%wa, 0.0%hi, 3.4%si, 0.0%st Cpu3 : 69.9%us, 0.8%sy, 0.0%ni, 24.9%id, 1.0%wa, 0.0%hi, 3.4%si, 0.0%st Thank You On 22 February 2014 04:09, John Hardin wrote: > On Sat, 22 Feb 2014, parakrama55 . wrote: > > Spmd parameters >> == >> >> ps aux | grep spamd >> root 6679 0.3 1.3 130064 66940 ?Ss 13:45 0:07 >> /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s >> /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid >> 102 8747 82.5 1.4 136320 73632 ?R14:22 2:23 spamd >> child >> nobody8754 85.8 1.4 136228 73600 ?R14:22 2:23 spamd >> child >> nobody8772 87.6 1.4 135980 73388 ?R14:22 2:07 spamd >> child >> 102 8814 84.2 1.4 136052 73368 ?D14:23 1:41 spamd >> child >> root 8979 0.0 0.0 6032 720 pts/0S+ 14:25 0:00 grep >> spamd >> >> > 2. Can you check your SA logs and see what the average scan times look >> like? >> >> Scan time varis beteen 1 - 20 seconds >> > > Yet exim times out? > > > 3 .Do you know how to change the timeout in the SA glue? >> No , please advice >> > > I'm not familiar with exim, sorry. > > > 4. What is your SA glue layer? >> >> Both exim and spamassin services runs in the same server , exim calls >> spamassin via 127.0.0.1 address >> >> 5. What hardware is devoted to SA? Is it perhaps overloaded? >> Its runs on vmware server >> > > I see 5GB RAM in the earlier mail, and no swap in use, so you appear OK > for RAM. How many CPUs does the VM have assigned? > > > -- > John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ > jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > --- > Maxim VI: If violence wasn't your last resort, you failed to resort > to enough of it. > > --- > Tomorrow: George Washington's 282nd Birthday >
Re: Spamassassin Timeout error
On Sat, 22 Feb 2014, parakrama55 . wrote: Spmd parameters == ps aux | grep spamd root 6679 0.3 1.3 130064 66940 ?Ss 13:45 0:07 /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid 102 8747 82.5 1.4 136320 73632 ?R14:22 2:23 spamd child nobody8754 85.8 1.4 136228 73600 ?R14:22 2:23 spamd child nobody8772 87.6 1.4 135980 73388 ?R14:22 2:07 spamd child 102 8814 84.2 1.4 136052 73368 ?D14:23 1:41 spamd child root 8979 0.0 0.0 6032 720 pts/0S+ 14:25 0:00 grep spamd 2. Can you check your SA logs and see what the average scan times look like? Scan time varis beteen 1 - 20 seconds Yet exim times out? 3 .Do you know how to change the timeout in the SA glue? No , please advice I'm not familiar with exim, sorry. 4. What is your SA glue layer? Both exim and spamassin services runs in the same server , exim calls spamassin via 127.0.0.1 address 5. What hardware is devoted to SA? Is it perhaps overloaded? Its runs on vmware server I see 5GB RAM in the earlier mail, and no swap in use, so you appear OK for RAM. How many CPUs does the VM have assigned? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- Maxim VI: If violence wasn’t your last resort, you failed to resort to enough of it. --- Tomorrow: George Washington's 282nd Birthday
Re: Spamassassin Timeout error
Hi guys Spmd parameters == ps aux | grep spamd root 6679 0.3 1.3 130064 66940 ?Ss 13:45 0:07 /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid 102 8747 82.5 1.4 136320 73632 ?R14:22 2:23 spamd child nobody8754 85.8 1.4 136228 73600 ?R14:22 2:23 spamd child nobody8772 87.6 1.4 135980 73388 ?R14:22 2:07 spamd child 102 8814 84.2 1.4 136052 73368 ?D14:23 1:41 spamd child root 8979 0.0 0.0 6032 720 pts/0S+ 14:25 0:00 grep spamd 1. If it is not happening on all messages, how large are the messages it is happening on? Yes now its happen for the all the messages 2. Can you check your SA logs and see what the average scan times look like? Scan time varis beteen 1 - 20 seconds 3 .Do you know how to change the timeout in the SA glue? No , please advice 4. What is your SA glue layer? Both exim and spamassin services runs in the same server , exim calls spamassin via 127.0.0.1 address 5. What hardware is devoted to SA? Is it perhaps overloaded? Its runs on vmware server Thank You On 22 February 2014 03:55, Kevin A. McGrail wrote: > What's your spamd parameters? something like ps aux | grep spamd > > >
Re: Spamassassin Timeout error
also in the message header i can see the following information getting added X-SA-Exim-Connect-IP: 10.100.2.1 X-SA-Exim-Mail-From: users-boun...@ihk.org X-SA-Exim-Scanned: No (on mail.ihk.org); SAEximRunCond expanded to false On 22 February 2014 03:58, parakrama55 . wrote: > Hi guys > > Spmd parameters > == > > ps aux | grep spamd > root 6679 0.3 1.3 130064 66940 ?Ss 13:45 0:07 > /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s > /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid > 102 8747 82.5 1.4 136320 73632 ?R14:22 2:23 spamd > child > nobody8754 85.8 1.4 136228 73600 ?R14:22 2:23 spamd > child > nobody8772 87.6 1.4 135980 73388 ?R14:22 2:07 spamd > child > 102 8814 84.2 1.4 136052 73368 ?D14:23 1:41 spamd > child > root 8979 0.0 0.0 6032 720 pts/0S+ 14:25 0:00 grep spamd > > > > 1. If it is not happening on all messages, how large are the messages it > is happening on? > > Yes now its happen for the all the messages > > 2. Can you check your SA logs and see what the average scan times look > like? > > Scan time varis beteen 1 - 20 seconds > > 3 .Do you know how to change the timeout in the SA glue? > No , please advice > > 4. What is your SA glue layer? > > Both exim and spamassin services runs in the same server , exim calls > spamassin via 127.0.0.1 address > > 5. What hardware is devoted to SA? Is it perhaps overloaded? > Its runs on vmware server > > Thank You > > > > On 22 February 2014 03:55, Kevin A. McGrail wrote: > >> What's your spamd parameters? something like ps aux | grep spamd >> >> >> >
Re: Spamassassin Timeout error
What's your spamd parameters? something like ps aux | grep spamd
Re: Spamassassin Timeout error
Hi guys thanks for the updae i have running simple spamaasain setup for 1 year now , it working fine up to yesterday , After that spamassain server stated to run in higher load and cpu usage even during the time ware no mails mail que. We have exim server and spamassain server runs in the same machine ( Operating system Debian 6) Here is output of the top command === Tasks: 179 total, 5 running, 174 sleeping, 0 stopped, 0 zombie Cpu(s): 91.8%us, 0.4%sy, 0.0%ni, 7.1%id, 0.0%wa, 0.0%hi, 0.6%si, 0.0%st Mem: 5097380k total, 555760k used, 4541620k free,63740k buffers Swap: 477176k total,0k used, 477176k free, 104396k cached PID USER PR NI VIRT RES SHR S %CPU %MEMTIME+ COMMAND 6701 nobody20 0 136m 74m 2824 R 83 1.5 14:12.38 spamd 6700 nobody20 0 135m 74m 2836 R 98 1.5 14:03.64 spamd 6705 Debian-e 20 0 135m 74m 2824 R 88 1.5 14:10.12 spamd 6706 Debian-e 20 0 134m 73m 2824 R 99 1.5 14:20.74 spamd 6679 root 20 0 127m 65m 2284 S0 1.3 0:05.62 spamd 1318 root 20 0 40872 8736 1364 S0 0.2 0:02.71 python 1284 snmp 20 0 47568 5152 2800 S0 0.1 0:01.89 snmpd 1277 root 20 0 78704 3812 2924 S0 0.1 0:08.14 vmtoolsd in our spamassin log we are continuously getting timeout error ? 2014-02-21 14:14:53 1WGyJ0-00027w-3p SMTP connection lost after final dot H= p5798a690.dip0.t-ipconnect.de [87.152.166.144] P=esmtp 2014-02-21 14:14:53 1WGyMp-0002AY-Ft spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection timed out 2014-02-21 14:14:53 1WGyMp-0002AY-Ft spam acl condition: all spamd servers failed 2014-02-21 14:14:53 1WGyMp-0002AY-Ft H=(client-200.121.7.219.speedy.net.pe) [200.121.7.219] Warning: ACL "warn" statement skipped: condition test deferred 2014-02-21 14:14:53 no IP address found for host host-186-101-186-114.uio.netlife.ec (during SMTP connection from [186.101.186.114]) 2014-02-21 14:14:54 1WGyKz-00029K-Gz spam acl condition: error reading from spamd socket: Connection timed out 2014-02-21 14:14:54 1WGyKz-00029K-Gz H= dslb-088-070-068-158.pools.arcor-ip.net [88.70.68.158] Warning: ACL "warn" statement skipped: condition test deferred 2014-02-21 14:14:54 1WGyKz-00029N-JG spam acl condition: error reading from spamd socket: Connection timed out 2014-02-21 14:14:54 1WGyKz-00029N-JG H=([177.53.108.184]) [177.53.108.184] Warning: ACL "warn" statement skipped: condition test deferred 2014-02-21 14:14:54 1WGyKv-00029G-3w spam acl condition: error reading from spamd socket: Connection timed out 2014-02-21 14:14:54 1WGyKv-00029G-3w SA: Debug: SAEximRunCond expand returned: '0' 2014-02-21 14:14:54 1WGyKv-00029G-3w SA: Action: Not running SA because SAEximRunCond expanded to false (Message-Id: 1WGyKv-00029G-3w). From < e1jnrtv-00028o...@cdsdoors.com> (host=NULL [179.180.28.209] Im not sure where to look at and how fix the issue , please advice Thanks On 21 February 2014 22:22, John Hardin wrote: > On Fri, 21 Feb 2014, parakrama55 . wrote: > > we are getting follwing errors in the logs, >> >> 2014-02-21 05:50:27 1WGqSi-0003d7-Pi spam acl condition: error reading >> from >> spamd socket: Connection timed out >> 2014-02-21 05:50:27 1WGqSi-0003dD-9p spam acl condition: error reading >> from >> spamd socket: Connection timed out >> >> Seems like because of this mail server ignore spamassain check >> >> Is there any reason for that , Please advice how to fix this issue >> > > We need some more information before we can provide any meaningful advice. > > The most important questions are: > > What is your SA glue layer? (How is SA hooked into your MTA? There are > several ways this can be done.) > > Do you know what the timeout in the SA glue is currently set to? > > Do you know how to change the timeout in the SA glue? > > Other questions needed to offer advice more specific than just "increase > the timeout" are: > > How frequently is this happening? > > If it is not happening on all messages, how large are the messages it is > happening on? > > Can you check your SA logs and see what the average scan times look like? > > What hardware is devoted to SA? Is it perhaps overloaded? > > > -- > John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ > jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > --- > The Tea Party wants to remove the Crony from Crony Capitalism. > OWS wants to remove Capitalism from Crony Capitalism. > -- Astaghfirullah > --- > Tomorrow: George Washington's 282nd Birthday >
Re: Spamassassin Timeout error
On Fri, 21 Feb 2014, parakrama55 . wrote: we are getting follwing errors in the logs, 2014-02-21 05:50:27 1WGqSi-0003d7-Pi spam acl condition: error reading from spamd socket: Connection timed out 2014-02-21 05:50:27 1WGqSi-0003dD-9p spam acl condition: error reading from spamd socket: Connection timed out Seems like because of this mail server ignore spamassain check Is there any reason for that , Please advice how to fix this issue We need some more information before we can provide any meaningful advice. The most important questions are: What is your SA glue layer? (How is SA hooked into your MTA? There are several ways this can be done.) Do you know what the timeout in the SA glue is currently set to? Do you know how to change the timeout in the SA glue? Other questions needed to offer advice more specific than just "increase the timeout" are: How frequently is this happening? If it is not happening on all messages, how large are the messages it is happening on? Can you check your SA logs and see what the average scan times look like? What hardware is devoted to SA? Is it perhaps overloaded? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- The Tea Party wants to remove the Crony from Crony Capitalism. OWS wants to remove Capitalism from Crony Capitalism. -- Astaghfirullah --- Tomorrow: George Washington's 282nd Birthday
