Hi Thanks for the reply.
The basic setup is as follows. We have incoming SMTP servers running Exim 4.30 with the latest ExiScan patch. Mail is then palmed off to the spamd run on another server. Mail is then scanned and a report is supplied back to the Exim MTA. The only monitoring I am doing is a ps check counting the number of spamd procs that are running, if there is 0 = problem or >251 = problem. I don't think that is the prob seeing that when I did used to check the port, it would crash with an error such as this. The spamd server(s) is also behind a firewall and the only connection made to it is from the incoming smtp servers. Feb 25 17:30:21 01-spam spamd[24273]: Use of uninitialized value in subroutine entry at /usr/lib/perl5/5.8.1/i386-linux-thread-multi/Socket.pm line 370. I can send more of the strace if you would like as I have about 11GB of it :) I can aslo include debug info for the spamd process. I did review the debug output from the spamd proc when it died and it looks likes like it would normally complete a message, just the spamd dies so it never spawns any more probs... Ill keep looking. This particularly happens when I enable health monitoring from a Radware Load Balancer Switch. What can be done about spamd dying when a simple nmap or telnet to port 783 takes place. Thanks -- Regards Richard Mayhew Unix Specialist MWEB Business Tel: + 27 11 340 7200 Fax: + 27 11 340 7288 Website: www.mwebbusiness.co.za -----Original Message----- From: Nick Leverton [mailto:[EMAIL PROTECTED] Sent: 25 March 2004 02:53 PM To: Richard Mayhew Cc: [EMAIL PROTECTED] Subject: Re: SPAMD Keeps Dying - UPDATE On Thu, Mar 25, 2004 at 02:29:54PM +0200, Richard Mayhew wrote: > Hi All, > > I seem to have narrowed the problem down to this. I did a strace on the > main spamd process and watched it for sometime. > Just before the spamd dies, I get this output. Bearing in mind nothing > is logged when spamd is in debug mode. > > Going through it as best I can see it seems to be referring to a LOCALE > file which does not exist. > What seems strange is that its happening on both systems, both Linux and > FreeBSD. I can't see why these files would be missing. > > Can anyone shed some light on to this? I haven't kept the earlier messages in the thread, but I suspect the locale stuff is a bit of a red herring. It's trying to find appropriate error messages, but should still fall back to the standard ones. The trace seems to show a connection that closed early, which it's trying to report. Is it possible something is making connections to spamd's port and then exiting without doing a scan ? That is known to cause spamd to die. It may be innocent and inadvertent (perhaps you have something monitoring it), or it may be down to an nmap or similar scan. You could tcpdump connections to port 783 to check this out. Nick
