You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "J." <sw...@yahoo.com> on 2007/04/09 20:30:15 UTC
spamd: server killed by SIGTERM
I got an obvious spam a little while ago that got scored
"X-Spam-Status: No, hits=? required=?" so I looked up the message in
the system log. Check out line 5 below (server killed by SIGTERM):
Apr 9 10:35:02 localhost spamd[8657]: spamd: result: Y 14 -
BAYES_99,RCVD_IN_NJABL_DUL,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RCVD_IN_SORBS_WEB,RCVD_IN_WHOIS_INVALID
scantime=3.3,size=2004,user=qscand,uid=210,required_score=3.5,rhost=binaryops.com,raddr=127.0.0.1,rport=54467,mid=<01...@wiserrelinquish>,bayes=0.999999999180551,autolearn=no
Apr 9 10:35:02 localhost spamd[25816]: prefork: child states: II
Apr 9 10:35:10 localhost spamd[8657]: spamd: connection from
binaryops.com [127.0.0.1] at port 54468
Apr 9 10:35:10 localhost spamd[8657]: spamd: checking message
<01...@agczz> for qscand:210
Apr 9 10:35:10 localhost spamd[25816]: spamd: server killed by
SIGTERM, shutting down
Apr 9 10:35:12 localhost spamc[20856]: connect(AF_INET) to spamd at
127.0.0.1 failed, retrying (#1 of 3): Connection refused
Apr 9 10:35:13 localhost spamd[20844]: logger: removing stderr method
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test
DIGEST_MULTIPLE has undefined dependency 'DCC_CHECK'
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test DRUGS_ERECTILE
has undefined dependency '__DRUGS_ERECTILE7'
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test
SARE_SPEC_PROLEO_M2a has dependency 'MIME_QP_LONG_LINE' with a zero
score
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test
__POPULAR_PRICES2 has undefined dependency '__CREATIVE_PRICE'
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test
SARE_OEM_POP_PRICES3 has undefined dependency '__CREATIVE_PRICE'
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test SARE_RD_SAFE
has undefined dependency 'SARE_RD_SAFE_MKSHRT'
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test SARE_RD_SAFE
has undefined dependency 'SARE_RD_SAFE_GT'
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test SARE_RD_SAFE
has undefined dependency 'SARE_RD_SAFE_TINY'
Apr 9 10:35:15 localhost spamd[20859]: rules: meta test
SARE_OBFU_CIALIS has undefined dependency 'SARE_OBFU_CIALIS2'
Apr 9 10:35:15 localhost spamd[20859]: spamd: server started on port
783/tcp (running version 3.1.8)
Apr 9 10:35:15 localhost spamd[20859]: spamd: server pid: 20859
I think my system is up to date... When I run sa-update --debug
--checkonly I get this:
[25521] dbg: dns: 8.1.3.updates.spamassassin.org => 507739, parsed as
507739
[25521] dbg: channel: current version is 507739, new version is 507739,
skipping channel
[25521] dbg: diag: updates complete, exiting with code 1
This sigterm death seems to happen usually a couple of times a day
(sometimes it doesn't happen for days). I searched a bit and found a
bugzilla thing for something similar last week, but I don't think this
is the same error. If anyone has any idea... Thanks.
-Jason
____________________________________________________________________________________
Don't get soaked. Take a quick peek at the forecast
with the Yahoo! Search weather shortcut.
http://tools.search.yahoo.com/shortcuts/#loc_weather
Re: spamd: server killed by SIGTERM (every hour!)
Posted by Andy Spiegl <sp...@spiegl.de>.
> If you remember my log file, there were a bunch of days in a row with one
> to three of them, then three on April 8th, one on April 9th and none
> since then.
Well, it still could be some kind of watchdog that kills processes when
they use too much CPU or memory. That wouldn't happen on a regular basis
but only when lots of spam is coming in.
Andy.
--
Q: What's the difference between men and pigs?
A: Pigs don't turn into men when they get drunk!
Re: spamd: server killed by SIGTERM (every hour!)
Posted by "J." <sw...@yahoo.com>.
--- Andy Spiegl <sp...@spiegl.de> wrote:
> Hi Jason,
>
> I found the cause: my stupidess DOH!
>
> I've got a cronjob that kills processes which have been hanging
> around for
> too long. Two days ago I reconfigured it and made a mistake which
> lead to
> exactly this: spamd with etime of more than 60 minutes are killed
> with
> SIGTERM. This cronjob is really useful for other things but the
> admin
> should know how to configure it, DOHDOHDOH.
>
> Hm, maybe your situation is similar. Do you have some kind of
> watchdog
> running on your machine?
>
> > > Uiii, that is a LOT for one domain! Are you accepting ALL
> usernames
> > > for your domain or just the existing ones?
> >
> > I know. It's an old domain so we get a lot.
> I've got some old catchall-Domains myself but all domains together
> receive
> about 170000 Spams a week. So that'd be about 25000 per day. But
> that's
> about 500 domains on 5 mailservers!
>
> > I've been trying to figure out how to use the validrcptto patch on
> > Gentoo/netqmail 1.05, but it's apparently not that simple.
> Sorry, I've never heard of netqmail.
>
> > This is out of my league considering I'm having trouble figuring
> out how
> > to apply a fairly small patch.
> patch -q1 < patchfile ? :-)
>
> Sorry, I can't be of more help.
> Andy.
That's cool that you figured it out. In my case, I don't think that's
it since it doesn't happen on any time schedule. If you remember my log
file, there were a bunch of days in a row with one to three of them,
then three on April 8th, one on April 9th and none since then.
-Jason
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Re: spamd: server killed by SIGTERM (every hour!)
Posted by Andy Spiegl <sp...@spiegl.de>.
Hi Jason,
I found the cause: my stupidess DOH!
I've got a cronjob that kills processes which have been hanging around for
too long. Two days ago I reconfigured it and made a mistake which lead to
exactly this: spamd with etime of more than 60 minutes are killed with
SIGTERM. This cronjob is really useful for other things but the admin
should know how to configure it, DOHDOHDOH.
Hm, maybe your situation is similar. Do you have some kind of watchdog
running on your machine?
> > Uiii, that is a LOT for one domain! Are you accepting ALL usernames
> > for your domain or just the existing ones?
>
> I know. It's an old domain so we get a lot.
I've got some old catchall-Domains myself but all domains together receive
about 170000 Spams a week. So that'd be about 25000 per day. But that's
about 500 domains on 5 mailservers!
> I've been trying to figure out how to use the validrcptto patch on
> Gentoo/netqmail 1.05, but it's apparently not that simple.
Sorry, I've never heard of netqmail.
> This is out of my league considering I'm having trouble figuring out how
> to apply a fairly small patch.
patch -q1 < patchfile ? :-)
Sorry, I can't be of more help.
Andy.
--
Show me a piano falling down a mine shaft and I'll show you A-flat minor.
Re: spamd: server killed by SIGTERM (every hour!)
Posted by Andy Spiegl <sp...@spiegl.de>.
Hi Vincent,
> Are you running spamd/spamc as root? it is not recommended to run spamd
> as root.
I know, but so far I was too lazy setting it up to run as a user.
There are still some issues, e.g. when I start spamd with
use_auto_whitelist 1
and there is no file auto-whitelist yet, it is created for the user root
and then the spamd children don't have write access anymore. :-(
Chau,
Andy.
--
Experience is something you don't get until just after you need it.
-- Olivier
Re: spamd: server killed by SIGTERM (every hour!)
Posted by Vincent Li <vl...@vcn.bc.ca>.
On Fri, 13 Apr 2007, Andy Spiegl wrote:
>> Someone here suggested that it's a memory problem.
> Where? I didn't see any reply to your post.
>
> Most of my machines have 1gig RAM. That should be enough for the 5
> SA-children I thought...
>
>> The rate that it's occuring for you might support that if you handle a
>> lot of users.
> Yes, but my setup is not user-based. Just global configs.
>
>> only got one domain with around 20 users and about 2000-10000 spams a
>> day.
> Uiii, that is a LOT for one domain! Are you accepting ALL usernames for
> your domain or just the existing ones?
>
>> The SIGTERM hasn't happenned here since Monday, and I think that was the
>> last day in a series of days when we had a large wave of spam come in
>> (including a short but intense backscatter attack
> Same here, but with SA 3.0 I had no SIGTERMs at all.
> The whole problem started with the upgrade to 3.1.7.
>
> Here are the last two log lines _before_ the SIGTERM, maybe that helps to
> find my problem?
>
> btw, I just installed "libsys-hostname-long-perl" to get rid
> of the "Can't locate Sys/Hostname/Long.pm" error.
>
> gold.akte.de:~#grep -B 2 "server killed by SIGTERM" /var/log/spamd.log
> Fri Apr 13 10:00:02 2007 [6751] info: spamd: result: Y 5 - BAYES_99,DATE_IN_FUTURE_03_06,FORGED_RCVD_HELO scantime=3.2,size=1029,user=root,uid=0,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd.socket,mid=<01...@accessoriesdownbeat>,bayes=0.999999999999888,autolearn=no
> Fri Apr 13 10:00:02 2007 [20395] info: prefork: child states: II
> Fri Apr 13 10:00:09 2007 [20395] info: spamd: server killed by SIGTERM, shutting down
> --
> Fri Apr 13 11:11:03 2007 [1830] info: spamd: processing message <00...@athedsl-139216.home.otenet.gr> for root:0
> Fri Apr 13 11:11:03 2007 [1830] error: Can't locate Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl) at /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN934> line 40.
> Fri Apr 13 11:11:09 2007 [14822] info: spamd: server killed by SIGTERM, shutting down
> --
> Fri Apr 13 12:22:01 2007 [3826] info: spamd: got connection over /var/run/spamd.socket
> Fri Apr 13 12:22:01 2007 [3826] info: spamd: processing message <00...@com201> for root:0
> Fri Apr 13 12:22:14 2007 [10643] info: spamd: server killed by SIGTERM, shutting down
> --
> Fri Apr 13 13:33:05 2007 [367] info: spamd: result: Y 31 - BAYES_99,EXTRA_MPART_TYPE,HELO_DYNAMIC_IPADDR,HTML_40_50,HTML_IMAGE_ONLY_24,HTML_MESSAGE,HTML_TAG_BALANCE_BODY,INLINE_IMAGE,MY_CID_AND_ARIAL2,MY_CID_AND_STYLE,MY_CID_ARIAL_STYLE,PART_CID_STOCK,TVD_FW_GRAPHIC_ID1,TW_PM,TW_WM,URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_WS_SURBL scantime=8.2,size=11271,user=root,uid=0,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd.socket,mid=<00...@casarxl4wvmzol>,bayes=1,autolearn=spam
> Fri Apr 13 13:33:05 2007 [5784] info: prefork: child states: IB
> Fri Apr 13 13:33:08 2007 [5784] info: spamd: server killed by SIGTERM, shutting down
> --
> Fri Apr 13 14:44:09 2007 [19326] info: spamd: processing message <D4...@media.pl> for root:0
> Fri Apr 13 14:44:09 2007 [19326] error: Can't locate Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl) at /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN1257> line 39.
> Fri Apr 13 14:44:09 2007 [2197] info: spamd: server killed by SIGTERM, shutting down
> --
> Fri Apr 13 15:55:03 2007 [21280] info: spamd: processing message <00...@PC9> for root:0
> Fri Apr 13 15:55:03 2007 [21280] error: Can't locate Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl) at /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN1425> line 194.
> Fri Apr 13 15:55:09 2007 [31206] info: spamd: server killed by SIGTERM, shutting down
> --
> Fri Apr 13 17:00:08 2007 [22160] info: spamd: got connection over /var/run/spamd.socket
> Fri Apr 13 17:00:08 2007 [22160] info: spamd: processing message (unknown) for root:0
> Fri Apr 13 17:00:13 2007 [29550] info: spamd: server killed by SIGTERM, shutting down
>
>
> Thanks,
> Andy.
>
Are you running spamd/spamc as root? it is not recommended to run spamd as
root.
Vincent Li
http://bl0g.blogdns.com
Re: spamd: server killed by SIGTERM (every hour!)
Posted by "J." <sw...@yahoo.com>.
--- Andy Spiegl <sp...@spiegl.de> wrote:
> > Someone here suggested that it's a memory problem.
> Where? I didn't see any reply to your post.
Sorry, it was on the Gentoo forum, not here. Here's the thread, not
much beyond what I mentioned though so not sure it will help:
http://forums.gentoo.org/viewtopic-p-4004792.html#4004792
> Most of my machines have 1gig RAM. That should be enough for the 5
> SA-children I thought...
Mine too.
> > The rate that it's occuring for you might support that if you
> handle a
> > lot of users.
> Yes, but my setup is not user-based. Just global configs.
>
> > only got one domain with around 20 users and about 2000-10000 spams
> a
> > day.
> Uiii, that is a LOT for one domain! Are you accepting ALL usernames
> for
> your domain or just the existing ones?
I know. It's an old domain so we get a lot. Also, yes, we're accepting
everything, which sucks. I've been trying to figure out how to use the
validrcptto patch on Gentoo/netqmail 1.05, but it's apparently not that
simple.
> > The SIGTERM hasn't happenned here since Monday, and I think that
> was the
> > last day in a series of days when we had a large wave of spam come
> in
> > (including a short but intense backscatter attack
> Same here, but with SA 3.0 I had no SIGTERMs at all.
> The whole problem started with the upgrade to 3.1.7.
I'm using 3.1.8 with qmail-scanner.
> Here are the last two log lines _before_ the SIGTERM, maybe that
> helps to
> find my problem?
I don't know, I see the prefork messages all over my log file even when
there's no crash. It's possible that a certain type of message causes
it, or maybe it's just getting overloaded. This is out of my league
considering I'm having trouble figuring out how to apply a fairly small
patch.
> btw, I just installed "libsys-hostname-long-perl" to get rid
> of the "Can't locate Sys/Hostname/Long.pm" error.
>
> gold.akte.de:~#grep -B 2 "server killed by SIGTERM"
> /var/log/spamd.log
> Fri Apr 13 10:00:02 2007 [6751] info: spamd: result: Y 5 -
> BAYES_99,DATE_IN_FUTURE_03_06,FORGED_RCVD_HELO
>
scantime=3.2,size=1029,user=root,uid=0,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd.socket,mid=<01...@accessoriesdownbeat>,bayes=0.999999999999888,autolearn=no
> Fri Apr 13 10:00:02 2007 [20395] info: prefork: child states: II
> Fri Apr 13 10:00:09 2007 [20395] info: spamd: server killed by
> SIGTERM, shutting down
> --
> Fri Apr 13 11:11:03 2007 [1830] info: spamd: processing message
> <00...@athedsl-139216.home.otenet.gr> for
> root:0
> Fri Apr 13 11:11:03 2007 [1830] error: Can't locate
> Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib
> /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4
> /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8
> /usr/share/perl/5.8 /usr/local/lib/site_perl) at
> /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN934> line 40.
> Fri Apr 13 11:11:09 2007 [14822] info: spamd: server killed by
> SIGTERM, shutting down
> --
> Fri Apr 13 12:22:01 2007 [3826] info: spamd: got connection over
> /var/run/spamd.socket
> Fri Apr 13 12:22:01 2007 [3826] info: spamd: processing message
> <00...@com201> for root:0
> Fri Apr 13 12:22:14 2007 [10643] info: spamd: server killed by
> SIGTERM, shutting down
> --
> Fri Apr 13 13:33:05 2007 [367] info: spamd: result: Y 31 -
>
BAYES_99,EXTRA_MPART_TYPE,HELO_DYNAMIC_IPADDR,HTML_40_50,HTML_IMAGE_ONLY_24,HTML_MESSAGE,HTML_TAG_BALANCE_BODY,INLINE_IMAGE,MY_CID_AND_ARIAL2,MY_CID_AND_STYLE,MY_CID_ARIAL_STYLE,PART_CID_STOCK,TVD_FW_GRAPHIC_ID1,TW_PM,TW_WM,URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_WS_SURBL
>
scantime=8.2,size=11271,user=root,uid=0,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd.socket,mid=<00...@casarxl4wvmzol>,bayes=1,autolearn=spam
> Fri Apr 13 13:33:05 2007 [5784] info: prefork: child states: IB
> Fri Apr 13 13:33:08 2007 [5784] info: spamd: server killed by
> SIGTERM, shutting down
> --
> Fri Apr 13 14:44:09 2007 [19326] info: spamd: processing message
> <D4...@media.pl> for root:0
> Fri Apr 13 14:44:09 2007 [19326] error: Can't locate
> Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib
> /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4
> /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8
> /usr/share/perl/5.8 /usr/local/lib/site_perl) at
> /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN1257> line 39.
> Fri Apr 13 14:44:09 2007 [2197] info: spamd: server killed by
> SIGTERM, shutting down
> --
> Fri Apr 13 15:55:03 2007 [21280] info: spamd: processing message
> <00...@PC9> for root:0
> Fri Apr 13 15:55:03 2007 [21280] error: Can't locate
> Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib
> /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4
> /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8
> /usr/share/perl/5.8 /usr/local/lib/site_perl) at
> /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN1425> line 194.
> Fri Apr 13 15:55:09 2007 [31206] info: spamd: server killed by
> SIGTERM, shutting down
> --
> Fri Apr 13 17:00:08 2007 [22160] info: spamd: got connection over
> /var/run/spamd.socket
> Fri Apr 13 17:00:08 2007 [22160] info: spamd: processing message
> (unknown) for root:0
> Fri Apr 13 17:00:13 2007 [29550] info: spamd: server killed by
> SIGTERM, shutting down
>
>
> Thanks,
> Andy.
>
> --
> The difference between the right word and nearly the right word
> is the same as the difference between lightning and a lightning bug.
>
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Re: spamd: server killed by SIGTERM (every hour!)
Posted by Andy Spiegl <sp...@spiegl.de>.
> Someone here suggested that it's a memory problem.
Where? I didn't see any reply to your post.
Most of my machines have 1gig RAM. That should be enough for the 5
SA-children I thought...
> The rate that it's occuring for you might support that if you handle a
> lot of users.
Yes, but my setup is not user-based. Just global configs.
> only got one domain with around 20 users and about 2000-10000 spams a
> day.
Uiii, that is a LOT for one domain! Are you accepting ALL usernames for
your domain or just the existing ones?
> The SIGTERM hasn't happenned here since Monday, and I think that was the
> last day in a series of days when we had a large wave of spam come in
> (including a short but intense backscatter attack
Same here, but with SA 3.0 I had no SIGTERMs at all.
The whole problem started with the upgrade to 3.1.7.
Here are the last two log lines _before_ the SIGTERM, maybe that helps to
find my problem?
btw, I just installed "libsys-hostname-long-perl" to get rid
of the "Can't locate Sys/Hostname/Long.pm" error.
gold.akte.de:~#grep -B 2 "server killed by SIGTERM" /var/log/spamd.log
Fri Apr 13 10:00:02 2007 [6751] info: spamd: result: Y 5 - BAYES_99,DATE_IN_FUTURE_03_06,FORGED_RCVD_HELO scantime=3.2,size=1029,user=root,uid=0,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd.socket,mid=<01...@accessoriesdownbeat>,bayes=0.999999999999888,autolearn=no
Fri Apr 13 10:00:02 2007 [20395] info: prefork: child states: II
Fri Apr 13 10:00:09 2007 [20395] info: spamd: server killed by SIGTERM, shutting down
--
Fri Apr 13 11:11:03 2007 [1830] info: spamd: processing message <00...@athedsl-139216.home.otenet.gr> for root:0
Fri Apr 13 11:11:03 2007 [1830] error: Can't locate Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl) at /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN934> line 40.
Fri Apr 13 11:11:09 2007 [14822] info: spamd: server killed by SIGTERM, shutting down
--
Fri Apr 13 12:22:01 2007 [3826] info: spamd: got connection over /var/run/spamd.socket
Fri Apr 13 12:22:01 2007 [3826] info: spamd: processing message <00...@com201> for root:0
Fri Apr 13 12:22:14 2007 [10643] info: spamd: server killed by SIGTERM, shutting down
--
Fri Apr 13 13:33:05 2007 [367] info: spamd: result: Y 31 - BAYES_99,EXTRA_MPART_TYPE,HELO_DYNAMIC_IPADDR,HTML_40_50,HTML_IMAGE_ONLY_24,HTML_MESSAGE,HTML_TAG_BALANCE_BODY,INLINE_IMAGE,MY_CID_AND_ARIAL2,MY_CID_AND_STYLE,MY_CID_ARIAL_STYLE,PART_CID_STOCK,TVD_FW_GRAPHIC_ID1,TW_PM,TW_WM,URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_WS_SURBL scantime=8.2,size=11271,user=root,uid=0,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd.socket,mid=<00...@casarxl4wvmzol>,bayes=1,autolearn=spam
Fri Apr 13 13:33:05 2007 [5784] info: prefork: child states: IB
Fri Apr 13 13:33:08 2007 [5784] info: spamd: server killed by SIGTERM, shutting down
--
Fri Apr 13 14:44:09 2007 [19326] info: spamd: processing message <D4...@media.pl> for root:0
Fri Apr 13 14:44:09 2007 [19326] error: Can't locate Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl) at /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN1257> line 39.
Fri Apr 13 14:44:09 2007 [2197] info: spamd: server killed by SIGTERM, shutting down
--
Fri Apr 13 15:55:03 2007 [21280] info: spamd: processing message <00...@PC9> for root:0
Fri Apr 13 15:55:03 2007 [21280] error: Can't locate Sys/Hostname/Long.pm in @INC (@INC contains: lib ../lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl) at /usr/share/perl5/Mail/SPF/Query.pm line 328, <GEN1425> line 194.
Fri Apr 13 15:55:09 2007 [31206] info: spamd: server killed by SIGTERM, shutting down
--
Fri Apr 13 17:00:08 2007 [22160] info: spamd: got connection over /var/run/spamd.socket
Fri Apr 13 17:00:08 2007 [22160] info: spamd: processing message (unknown) for root:0
Fri Apr 13 17:00:13 2007 [29550] info: spamd: server killed by SIGTERM, shutting down
Thanks,
Andy.
--
The difference between the right word and nearly the right word
is the same as the difference between lightning and a lightning bug.
Re: spamd: server killed by SIGTERM (every hour!)
Posted by "J." <sw...@yahoo.com>.
--- Duane Hill <d....@yournetplus.com> wrote:
> On Fri, 13 Apr 2007, J. wrote:
>
> > --- Andy Spiegl <sp...@spiegl.de> wrote:
> >
> >> I seem to have the same problem!
> >>
> >> Yesterday I upgraded from 3.0 to 3.1
> >> (to be exact: 3.0.3-2sarge1 to 3.1.7-1~bpo.1 from Debian
> backports)
> >> and now ALL spamds terminate after a while. And I have no clue
> why!
> >>
> >> The worst part is that spamc returns the messages unprocessed if
> it
> >> cannot
> >> connect to spamd and thus hundreds of SPAMs slip through. Try to
> >> explain
> >> that to my users... *sigh*
> >>
> >> So I wrote a small daemon that checks every 75 seconds whether the
> >> SpamAssassin daemons are still running. Every 60-70mins it has to
> >> restart them. And this happens not only on 1 server but 25!
> >>
> >> I wonder why only Jason and me seem to have this problem
> >>
> >> Grateful for any hint!
> >> Andy.
> >>
>
> <LOGS SNIPPED>
>
> >
> > Someone here suggested that it's a memory problem. The rate that
> it's
> > occuring for you might support that if you handle a lot of users.
> I've
> > only got one domain with around 20 users and about 2000-10000 spams
> a
> > day. The SIGTERM hasn't happenned here since Monday, and I think
> that
> > was the last day in a series of days when we had a large wave of
> spam
> > come in (including a short but intense backscatter attack - still
> > trying to figure out how to patch netqmail for recipient
> verification
> > on Gentoo by the way):
>
> <LOGS SNIPPED>
>
> I haven't seen this issue yet. Two dedicated servers here are
> processing
> roughly 4.5 million messages per day. I just went back through the
> server
> logs for the past three months and haven't seen any SIGTERM messages
> in
> any log files related to spamd.
>
> One of the filter servers here has 4x3ghz processors and 12 gig ram.
> I'm
> using these options for spamd:
>
> --username=spamd --groupname=spamd --min-children=8
> --max-children=32
> --min-spare=16 --max-spare=18 --max-conn-per-child=120
> --timeout-tcp=15
> --timeout-child=120
>
> This has been running flawless now for almost the three months this
> filter
> server has been in operation.
>
> The other server is about half the power so the spamd options are
> toned
> down. Other than that, it too hasn't seen any SIGTERM messages in any
> log
> files.
>
> Both servers are running FreeBSD. One is running 5.5-RELEASE-p9 and
> the
> other is running 6.1-RELEASE-p10.
Showoff! My machine is running Gentoo (latest) and has 1gb ram and a
Core 2 Duo running at probably 2.4ghz or so. Here are the flags spamd
gets (from /etc/conf.d/spamd):
SPAMD_OPTS="-m 5 -u qscand -x -H /etc/mail/spamassassin/"
PIDFILE="/var/run/spamd/spamd.pid"
and that's it, everything else must be running the default settings.
Recommendations? It's mainly a web server so I wouldn't want to let
spamd hog too much of the resources. Thanks.
-Jason
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Re: spamd: server killed by SIGTERM (every hour!)
Posted by Duane Hill <d....@yournetplus.com>.
On Fri, 13 Apr 2007, J. wrote:
> --- Andy Spiegl <sp...@spiegl.de> wrote:
>
>> I seem to have the same problem!
>>
>> Yesterday I upgraded from 3.0 to 3.1
>> (to be exact: 3.0.3-2sarge1 to 3.1.7-1~bpo.1 from Debian backports)
>> and now ALL spamds terminate after a while. And I have no clue why!
>>
>> The worst part is that spamc returns the messages unprocessed if it
>> cannot
>> connect to spamd and thus hundreds of SPAMs slip through. Try to
>> explain
>> that to my users... *sigh*
>>
>> So I wrote a small daemon that checks every 75 seconds whether the
>> SpamAssassin daemons are still running. Every 60-70mins it has to
>> restart them. And this happens not only on 1 server but 25!
>>
>> I wonder why only Jason and me seem to have this problem
>>
>> Grateful for any hint!
>> Andy.
>>
<LOGS SNIPPED>
>
> Someone here suggested that it's a memory problem. The rate that it's
> occuring for you might support that if you handle a lot of users. I've
> only got one domain with around 20 users and about 2000-10000 spams a
> day. The SIGTERM hasn't happenned here since Monday, and I think that
> was the last day in a series of days when we had a large wave of spam
> come in (including a short but intense backscatter attack - still
> trying to figure out how to patch netqmail for recipient verification
> on Gentoo by the way):
<LOGS SNIPPED>
I haven't seen this issue yet. Two dedicated servers here are processing
roughly 4.5 million messages per day. I just went back through the server
logs for the past three months and haven't seen any SIGTERM messages in
any log files related to spamd.
One of the filter servers here has 4x3ghz processors and 12 gig ram. I'm
using these options for spamd:
--username=spamd --groupname=spamd --min-children=8 --max-children=32
--min-spare=16 --max-spare=18 --max-conn-per-child=120 --timeout-tcp=15
--timeout-child=120
This has been running flawless now for almost the three months this filter
server has been in operation.
The other server is about half the power so the spamd options are toned
down. Other than that, it too hasn't seen any SIGTERM messages in any log
files.
Both servers are running FreeBSD. One is running 5.5-RELEASE-p9 and the
other is running 6.1-RELEASE-p10.
Re: spamd: server killed by SIGTERM (every hour!)
Posted by "J." <sw...@yahoo.com>.
--- Andy Spiegl <sp...@spiegl.de> wrote:
> I seem to have the same problem!
>
> Yesterday I upgraded from 3.0 to 3.1
> (to be exact: 3.0.3-2sarge1 to 3.1.7-1~bpo.1 from Debian backports)
> and now ALL spamds terminate after a while. And I have no clue why!
>
> The worst part is that spamc returns the messages unprocessed if it
> cannot
> connect to spamd and thus hundreds of SPAMs slip through. Try to
> explain
> that to my users... *sigh*
>
> So I wrote a small daemon that checks every 75 seconds whether the
> SpamAssassin daemons are still running. Every 60-70mins it has to
> restart them. And this happens not only on 1 server but 25!
>
> I wonder why only Jason and me seem to have this problem
>
> Grateful for any hint!
> Andy.
>
> gold.akte.de:~#grep "server killed by SIGTERM" /var/log/spamd.log
> Fri Apr 13 00:12:25 2007 [26466] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 01:22:06 2007 [26831] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 02:00:08 2007 [19154] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 03:00:15 2007 [32232] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 04:11:12 2007 [8981] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 05:22:12 2007 [1849] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 06:33:12 2007 [26001] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 07:44:07 2007 [18553] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 08:55:13 2007 [10795] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 10:00:09 2007 [20395] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 11:11:09 2007 [14822] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 12:22:14 2007 [10643] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 13:33:08 2007 [5784] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 14:44:09 2007 [2197] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 15:55:09 2007 [31206] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 17:00:13 2007 [29550] info: spamd: server killed by
> SIGTERM, shutting down
>
> lyta.akte.de:~#grep "server killed by SIGTERM" /var/log/spamd.log
> ...
> Fri Apr 13 11:22:05 2007 [29605] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 12:33:02 2007 [10722] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 13:44:06 2007 [24623] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 14:55:06 2007 [5075] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 16:00:02 2007 [18744] info: spamd: server killed by
> SIGTERM, shutting down
> Fri Apr 13 17:11:02 2007 [30826] info: spamd: server killed by
> SIGTERM, shutting down
>
> --
> It's easier to get forgiveness for being wrong
> than forgiveness for being right.
Someone here suggested that it's a memory problem. The rate that it's
occuring for you might support that if you handle a lot of users. I've
only got one domain with around 20 users and about 2000-10000 spams a
day. The SIGTERM hasn't happenned here since Monday, and I think that
was the last day in a series of days when we had a large wave of spam
come in (including a short but intense backscatter attack - still
trying to figure out how to patch netqmail for recipient verification
on Gentoo by the way):
Mar 28 13:40:42 localhost spamd[7941]: spamd: server killed by SIGTERM,
shutting down
Mar 31 12:08:31 localhost spamd[8616]: spamd: server killed by SIGTERM,
shutting down
Mar 31 12:19:00 localhost spamd[24698]: spamd: server killed by
SIGTERM, shutting down
Apr 1 03:56:40 localhost spamd[25448]: spamd: server killed by
SIGTERM, shutting down
Apr 3 17:25:39 localhost spamd[26815]: spamd: server killed by
SIGTERM, shutting down
Apr 4 14:51:42 localhost spamd[9535]: spamd: server killed by SIGTERM,
shutting down
Apr 6 04:18:40 localhost spamd[15059]: spamd: server killed by
SIGTERM, shutting down
Apr 6 16:24:13 localhost spamd[10926]: spamd: server killed by
SIGTERM, shutting down
Apr 6 16:32:28 localhost spamd[30350]: spamd: server killed by
SIGTERM, shutting down
Apr 7 13:19:52 localhost spamd[31101]: spamd: server killed by
SIGTERM, shutting down
Apr 8 10:17:30 localhost spamd[18510]: spamd: server killed by
SIGTERM, shutting down
Apr 8 10:18:21 localhost spamd[2210]: spamd: server killed by SIGTERM,
shutting down
Apr 8 16:23:32 localhost spamd[2574]: spamd: server killed by SIGTERM,
shutting down
Apr 9 10:35:10 localhost spamd[25816]: spamd: server killed by
SIGTERM, shutting down
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Re: spamd: server killed by SIGTERM (every hour!)
Posted by Andy Spiegl <sp...@spiegl.de>.
I seem to have the same problem!
Yesterday I upgraded from 3.0 to 3.1
(to be exact: 3.0.3-2sarge1 to 3.1.7-1~bpo.1 from Debian backports)
and now ALL spamds terminate after a while. And I have no clue why!
The worst part is that spamc returns the messages unprocessed if it cannot
connect to spamd and thus hundreds of SPAMs slip through. Try to explain
that to my users... *sigh*
So I wrote a small daemon that checks every 75 seconds whether the
SpamAssassin daemons are still running. Every 60-70mins it has to
restart them. And this happens not only on 1 server but 25!
I wonder why only Jason and me seem to have this problem
Grateful for any hint!
Andy.
gold.akte.de:~#grep "server killed by SIGTERM" /var/log/spamd.log
Fri Apr 13 00:12:25 2007 [26466] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 01:22:06 2007 [26831] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 02:00:08 2007 [19154] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 03:00:15 2007 [32232] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 04:11:12 2007 [8981] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 05:22:12 2007 [1849] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 06:33:12 2007 [26001] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 07:44:07 2007 [18553] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 08:55:13 2007 [10795] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 10:00:09 2007 [20395] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 11:11:09 2007 [14822] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 12:22:14 2007 [10643] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 13:33:08 2007 [5784] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 14:44:09 2007 [2197] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 15:55:09 2007 [31206] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 17:00:13 2007 [29550] info: spamd: server killed by SIGTERM, shutting down
lyta.akte.de:~#grep "server killed by SIGTERM" /var/log/spamd.log
...
Fri Apr 13 11:22:05 2007 [29605] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 12:33:02 2007 [10722] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 13:44:06 2007 [24623] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 14:55:06 2007 [5075] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 16:00:02 2007 [18744] info: spamd: server killed by SIGTERM, shutting down
Fri Apr 13 17:11:02 2007 [30826] info: spamd: server killed by SIGTERM, shutting down
--
It's easier to get forgiveness for being wrong
than forgiveness for being right.
Re: spamd: server killed by SIGTERM
Posted by "J." <sw...@yahoo.com>.
It doesn't seem excessive to me, though my whitelist is actually twice
this size. Here's my blacklist from local.cf:
blacklist_from *reunion.com *@taolasvegas.com *@steviva.com
*@punchstock.com *@elabs7.com
blacklist_from *rm05.net *adm02.com *@greatrewardsnow.net
*@zinester.com *agava.net *resultsactive.com
blacklist_from *@artfacts.net *winecountrygiftbaskets.com
*@thekeaneygroup.net *stun1.com *@afterhourpowerla.com
blacklist_from *@beautifuldolphin.com *sequinet.com
*@flashartonline.com *@recallgroup.com *bronto.com
blacklist_from *salesgenie-mail.com *mobilestorm.com
*bigfootinteractive.com *@driveoffer.info
--- Bill McCormick <wp...@sbcglobal.net> wrote:
> J. wrote:
>
> >I got an obvious spam a little while ago that got scored
> >"X-Spam-Status: No, hits=? required=?" so I looked up the message in
> >the system log. Check out line 5 below (server killed by SIGTERM):
> >
> >
> >
> I had a similar issue caused by using a very large blacklist; I took
> out
> the blacklist and the problem went away.
>
> [snip]
>
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Re: spamd: server killed by SIGTERM
Posted by Bill McCormick <wp...@sbcglobal.net>.
J. wrote:
>I got an obvious spam a little while ago that got scored
>"X-Spam-Status: No, hits=? required=?" so I looked up the message in
>the system log. Check out line 5 below (server killed by SIGTERM):
>
>
>
I had a similar issue caused by using a very large blacklist; I took out
the blacklist and the problem went away.
[snip]