You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Nick Bright <ni...@valnet.net> on 2018/08/01 16:12:39 UTC

Periodic error

spamd[1833]: plugin: eval failed: error closing socket: Bad file 
descriptor at 
/usr/share/perl5/vendor_perl/Mail/SpamAssassin/DnsResolver.pm line 185, 
<GEN45208> line 156.

I'm sometimes receiving this error in my maillog, certainly not for 
every message that gets scanned. It seems to come in bursts.

I've been unable to determine what's causing the error though. I'm 
running a BIND9 resolver on 127.0.0.1.

When it occurs, the system sees high load average and poor performance 
due to iowait caused by the error.

I don't think it's a file descriptor limit, as I've set my system to 
512,000 for /proc/sys/fs/file-max and 65535 for ulimits, and "sysctl 
fs.file-nr" shows 17,056 out of 512,000 in use.

Suggestions? Thoughts?

Thank you,

-- 
-----------------------------------------------
-  Nick Bright                                -
-  Vice President of Technology               -
-  Valnet -=- We Connect You -=-              -
-  Tel 888-332-1616 x 315 / Fax 620-331-0789  -
-  Web http://www.valnet.net/                 -
-----------------------------------------------
- Are your files safe?                        -
- Valnet Vault - Secure Cloud Backup          -
- More information & 30 day free trial at     -
- http://www.valnet.net/services/valnet-vault -
-----------------------------------------------


Re: Periodic error

Posted by Reio Remma <re...@mrstuudio.ee>.
On 02.08.18 3:46, Amir Caspi wrote:
> On Aug 1, 2018, at 6:09 PM, John Hardin <jh...@impsec.org> wrote:
>> Recommendation: download the spamassassin-3.4.1-12 (or later) SRPM from Fedora and try building an RPM from it in a Centos 6 dev environment. That's what I did for Centos 7 and it works jes' fine.
> Kevin Fenzi maintains an SA repo for RHEL/CentOS 6:
> https://copr.fedorainfracloud.org/coprs/kevin/spamassassin-el/
>
> It's up to date with 3.4.1.
>
> (There's one for CentOS 5, too, but not linked from that page.  Perhaps Kevin might be incentivized to add a CentOS 7 repo, too.)
>
> Cheers.
>
> --- Amir


I've anyone wants to try the CentOS 7 RPM I made for myself of the 
latest 3.4.2, then I just uploaded it to WeTransfer.

spamassassin-3.4.2-1837275.el7.x86_64.rpm

https://we.tl/y6lFCb988L

It's available there until 9th of August.

Good luck,
Reio

Re: Periodic error

Posted by Amir Caspi <ce...@3phase.com>.
On Aug 1, 2018, at 6:09 PM, John Hardin <jh...@impsec.org> wrote:
> Recommendation: download the spamassassin-3.4.1-12 (or later) SRPM from Fedora and try building an RPM from it in a Centos 6 dev environment. That's what I did for Centos 7 and it works jes' fine.

Kevin Fenzi maintains an SA repo for RHEL/CentOS 6:
https://copr.fedorainfracloud.org/coprs/kevin/spamassassin-el/

It's up to date with 3.4.1.

(There's one for CentOS 5, too, but not linked from that page.  Perhaps Kevin might be incentivized to add a CentOS 7 repo, too.)

Cheers.

--- Amir


Re: Periodic error

Posted by John Hardin <jh...@impsec.org>.
On Wed, 1 Aug 2018, Nick Bright wrote:

> On 8/1/2018 5:26 PM, Nick Bright wrote:
>> On 8/1/2018 4:58 PM, Bill Cole wrote:
>>> What version of SpamAssassin are you using? Those line numbers make no 
>>> sense with the 3.4.1 release or either current development branch. The 
>>> last version it seems to make sense for is 3.3.2, which is antique.
>> spamassassin-3.3.1-3.el6.x86_64 (CentOS 7 official package)
> Self correction, Centos 6 (hit the wrong key!)

Recommendation: download the spamassassin-3.4.1-12 (or later) SRPM from 
Fedora and try building an RPM from it in a Centos 6 dev environment. 
That's what I did for Centos 7 and it works jes' fine.

ooo, it looks like they are up to -18; I know what I'm doing this 
weekend... :)

https://dl.fedoraproject.org/pub/fedora/linux/releases/28/Everything/source/tree/Packages/s/spamassassin-3.4.1-18.fc28.src.rpm

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   Sheep have only two speeds: graze and stampede.     -- LTC Grossman
-----------------------------------------------------------------------
  3 days until the 283rd anniversary of John Peter Zenger's acquittal

Re: Periodic error

Posted by Nick Bright <ni...@valnet.net>.
On 8/1/2018 5:26 PM, Nick Bright wrote:
> On 8/1/2018 4:58 PM, Bill Cole wrote:
>> What version of SpamAssassin are you using? Those line numbers make 
>> no sense with the 3.4.1 release or either current development branch. 
>> The last version it seems to make sense for is 3.3.2, which is antique.
> spamassassin-3.3.1-3.el6.x86_64 (CentOS 7 official package)
Self correction, Centos 6 (hit the wrong key!)

-- 
-----------------------------------------------
-  Nick Bright                                -
-  Vice President of Technology               -
-  Valnet -=- We Connect You -=-              -
-  Tel 888-332-1616 x 315 / Fax 620-331-0789  -
-  Web http://www.valnet.net/                 -
-----------------------------------------------
- Are your files safe?                        -
- Valnet Vault - Secure Cloud Backup          -
- More information & 30 day free trial at     -
- http://www.valnet.net/services/valnet-vault -
-----------------------------------------------


Re: Periodic error

Posted by Nick Bright <ni...@valnet.net>.
On 8/1/2018 4:58 PM, Bill Cole wrote:
> What version of SpamAssassin are you using? Those line numbers make no 
> sense with the 3.4.1 release or either current development branch. The 
> last version it seems to make sense for is 3.3.2, which is antique.
spamassassin-3.3.1-3.el6.x86_64 (CentOS 7 official package)

>> Suggestions? Thoughts?
>
> Upgrade to a modern SpamAssassin. If that's not possible, make sure 
> that you are using a Net::DNS of a similar age to the antique SA.

I'll investigate doing so. I usually like to stay "on the reservation", 
but with such a fast moving target as spam, that may not be an option.

-- 
-----------------------------------------------
-  Nick Bright                                -
-  Vice President of Technology               -
-  Valnet -=- We Connect You -=-              -
-  Tel 888-332-1616 x 315 / Fax 620-331-0789  -
-  Web http://www.valnet.net/                 -
-----------------------------------------------
- Are your files safe?                        -
- Valnet Vault - Secure Cloud Backup          -
- More information & 30 day free trial at     -
- http://www.valnet.net/services/valnet-vault -
-----------------------------------------------


Re: Periodic error

Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 1 Aug 2018, at 12:12 (-0400), Nick Bright wrote:

> spamd[1833]: plugin: eval failed: error closing socket: Bad file 
> descriptor at 
> /usr/share/perl5/vendor_perl/Mail/SpamAssassin/DnsResolver.pm line 
> 185, <GEN45208> line 156.

What version of SpamAssassin are you using? Those line numbers make no 
sense with the 3.4.1 release or either current development branch. The 
last version it seems to make sense for is 3.3.2, which is antique.

This is particularly important because that module makes heavy use of 
the Net::DNS module, which has undergone a huge amount of change in 
recent years, much of it wise and some of it causing old code to break. 
If you are using a modern Net::DNS and an antique SpamAssassin, there 
will be trouble.

> I'm sometimes receiving this error in my maillog, certainly not for 
> every message that gets scanned. It seems to come in bursts.
>
> I've been unable to determine what's causing the error though. I'm 
> running a BIND9 resolver on 127.0.0.1.
>
> When it occurs, the system sees high load average and poor performance 
> due to iowait caused by the error.
>
> I don't think it's a file descriptor limit, as I've set my system to 
> 512,000 for /proc/sys/fs/file-max and 65535 for ulimits, and "sysctl 
> fs.file-nr" shows 17,056 out of 512,000 in use.

You are correct. This "file descriptor" is a socket being used for DNS 
resolution.

>
> Suggestions? Thoughts?

Upgrade to a modern SpamAssassin. If that's not possible, make sure that 
you are using a Net::DNS of a similar age to the antique SA.

-- 
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Currently Seeking Steadier Work: https://linkedin.com/in/billcole