You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Gino Semseo <sp...@semseoymas.org> on 2013/11/29 23:13:39 UTC
Spamassassin Child is just dying without advise...
Hello:
I need some support here, since I am getting crazy.... not always, but
often, SA childs die without advise during proccesing of an email...
Exim then just receive something like:
2013-11-29 20:29:01 1VmTkL-0002F8-5Q spam acl condition: cannot parse
spamd output
These are some logs...
/usr/local/cpanel/3rdparty/perl/514/bin/spamassassin -V
SpamAssassin version 3.3.2
running on Perl version 5.14.3
I have started spamd with -D for debugging:
Then...
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: ordered 38942 to
accept
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: sysread(7) not ready,
wait max 300 secs
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: entering
state 2
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
38944
Nov 29 16:00:55 hyperserver spamd[38942]: spamd: connection from
localhost [127.0.0.1] at port 44846
Nov 29 16:00:55 hyperserver spamd[38942]: spamd: setuid to diversia
succeeded
Nov 29 16:00:55 hyperserver spamd[38942]: config: read_scoreonly_config:
cannot open "/home/diversia/.spamassassin/user_prefs": No such file or
directory
Nov 29 16:00:55 hyperserver spamd[38942]: info: user has changed
Nov 29 16:00:55 hyperserver spamd[38942]: bayes: learner_new
self=Mail::SpamAssassin::Plugin::Bayes=HASH(0x3ac68d0),
bayes_store_module=Mail::SpamAssassin::$
Nov 29 16:00:55 hyperserver spamd[38942]: bayes: learner_new: got
store=Mail::SpamAssassin::BayesStore::DBM=HASH(0x5765450)
Nov 29 16:00:55 hyperserver spamd[38942]: bayes: tie-ing to DB file R/O
/etc/mail/spamassassin/bayes/bayes_toks
Nov 29 16:00:55 hyperserver spamd[38942]: bayes: tie-ing to DB file R/O
/etc/mail/spamassassin/bayes/bayes_seen
Nov 29 16:00:55 hyperserver spamd[38942]: bayes: found bayes db version
3
Nov 29 16:00:55 hyperserver spamd[38942]: bayes: DB journal sync: last
sync: 1385736975
Nov 29 16:00:55 hyperserver spamd[38942]: config: score set 3 chosen.
Nov 29 16:00:55 hyperserver spamd[38942]: spamd: running as uid 574
Nov 29 16:00:55 hyperserver spamd[38942]: config: time limit 300.0 s
Nov 29 16:00:55 hyperserver spamd[38942]: message: main message type:
multipart/mixed
...
...
...
...
etc
...
...
...
...
etc
...
...
...
Nov 29 16:00:55 hyperserver spamd[38942]: FreeMail: RULE (FREEMAIL_FROM)
check_freemail_from
Nov 29 16:00:55 hyperserver spamd[38942]: FreeMail: all from-addresses:
rcopero@vivagym.es
Nov 29 16:00:55 hyperserver spamd[38942]: spf: checking to see if the
message has a Received-SPF header that we can use
Nov 29 16:00:55 hyperserver spamd[38942]: spf: checking HELO
(helo=mail-vb0-f48.google.com, ip=209.85.212.48)
Nov 29 16:00:55 hyperserver spamd[38942]: dns: providing a callback for
id: 34562/mail-vb0-f48.google.com/SPF/IN
Nov 29 16:00:55 hyperserver spamd[38942]: dns: providing a callback for
id: 8678/mail-vb0-f48.google.com/TXT/IN
Nov 29 16:00:55 hyperserver spamd[38942]: spf: query for
/209.85.212.48/mail-vb0-f48.google.com: result: none, comment: , text:
No applicable sender policy available
Nov 29 16:00:55 hyperserver spamd[38942]: spf: already checked for
Received-SPF headers, proceeding with DNS based checks
Nov 29 16:00:55 hyperserver spamd[38942]: spf: found Envelope-From in
first external Received header
Nov 29 16:00:55 hyperserver spamd[38942]: spf: checking EnvelopeFrom
(helo=mail-vb0-f48.google.com, ip=209.85.212.48,
envfrom=rcopero@vivagym.es)
Nov 29 16:00:55 hyperserver spamd[38942]: dns: providing a callback for
id: 21188/vivagym.es/SPF/IN
Nov 29 16:00:55 hyperserver spamd[38942]: dns: providing a callback for
id: 44168/vivagym.es/TXT/IN
Nov 29 16:00:55 hyperserver spamd[38942]: spf: query for
rcopero@vivagym.es/209.85.212.48/mail-vb0-f48.google.com: result: none,
comment: , text: No applicable sender policy available
Nov 29 16:00:55 hyperserver spamd[38942]: FreeMail: RULE
(__freemail_reply) check_freemail_replyto
Nov 29 16:00:55 hyperserver spamd[38942]: FreeMail: From address:
rcopero@vivagym.es
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child closed
connection
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child states: BIIIII
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: just
exited
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: entering
state 4
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
38944
Nov 29 16:00:55 hyperserver spamd[38925]: spamd: handled cleanup of
child pid [38942] due to SIGCHLD: exit 1
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
38944
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: select returned err
Interrupted system call, probably signalled
Nov 29 16:00:55 hyperserver spamd[38925]: spamd: server successfully
spawned child process, pid 39240
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 39240: entering
state 0
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
38944
Nov 29 16:00:55 hyperserver spamd[39240]: plugin:
Mail::SpamAssassin::Plugin::ResourceLimits=HASH(0x3f9b328) implements
'spamd_child_init', priority 0
Nov 29 16:00:55 hyperserver spamd[39240]: resourcelimitplugin: In
spamd_child_init
Nov 29 16:00:55 hyperserver spamd[39240]: resourcelimitplugin: cpu
limit: 0
Nov 29 16:00:55 hyperserver spamd[39240]: resourcelimitplugin: mem
limit: 268435456
Nov 29 16:00:55 hyperserver spamd[39240]: prefork: sysread(12) not
ready, wait max 300 secs
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 39240: entering
state 1
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
38944
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child reports idle
Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child states: IIIIII
Bang! As you may see, the child just went out directly, as "prefork:
child closed connection" and "prefork: child 38942: just exited"...
Not always at the same point... by example, other one:
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running rawbody tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running full tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running meta tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: check: running tests for
priority: -900
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running one_line_body
tests; score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running head tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running head_eval
tests; score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: run_eval_tests -
compiling eval code: 9, priority -900
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running body tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running uri tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running body_eval
tests; score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: run_eval_tests -
compiling eval code: 11, priority -900
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running rawbody tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running full tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: rules: running meta tests;
score so far=-100
Nov 29 15:52:28 hyperserver spamd[34429]: check: running tests for
priority: -400
Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child closed
connection
Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child states: BIIIII
Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child 34429: just
exited
Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child 34429: entering
state 4
Nov 29 15:52:28 hyperserver spamd[34416]: prefork: new lowest idle kid:
34430
Nov 29 15:52:28 hyperserver spamd[34416]: spamd: handled cleanup of
child pid [34429] due to SIGCHLD: exit 1
I do not know what to do...
If I just execute spamassassin -t -D from shell, most times there is no
error and the message is fully scanned...
Could someone help me?
Thanks.
--
--
Gino
semseoymas
Re: Spamassassin Child is just dying without advise...
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Fri, 2013-11-29 at 23:13 +0100, Gino Semseo wrote:
> 2013-11-29 20:29:01 1VmTkL-0002F8-5Q spam acl condition: cannot parse spamd output
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: ordered 38942 to accept
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: sysread(7) not ready, wait max 300 secs
Why does sysread() fail?
That's the parent process, so reading from the child failed in
M::SA::SpamdForkScaling sysread_with_timeout(), and we're falling back
to blocking I/O.
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: entering state 2
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid: 38944
The child we just ordered to process a message now is busy (state 2).
Following lines are logged by the child.
> Nov 29 16:00:55 hyperserver spamd[38942]: spamd: connection from localhost [127.0.0.1] at port 44846
> Nov 29 16:00:55 hyperserver spamd[38942]: spamd: setuid to diversia succeeded
> Nov 29 16:00:55 hyperserver spamd[38942]: config: read_scoreonly_config:
> cannot open "/home/diversia/.spamassassin/user_prefs": No such file or directory
> Nov 29 16:00:55 hyperserver spamd[38942]: info: user has changed
> Nov 29 16:00:55 hyperserver spamd[38942]: bayes: DB journal sync: last sync: 1385736975
Last Bayes journal sync is just 5 minutes ago, Nov 29 15:56:15. That's
not necessarily bad, but seems a little odd given your configuration of
learning to journal:
bayes_learn_to_journal 1
bayes_journal_max_size 100000
The journal max size probably is not what you expect it to be. That
custom setting is hardly sufficiently different from the default 102400,
to even care about it.
> Nov 29 16:00:55 hyperserver spamd[38942]: config: score set 3 chosen.
> Nov 29 16:00:55 hyperserver spamd[38942]: spamd: running as uid 574
> Nov 29 16:00:55 hyperserver spamd[38942]: config: time limit 300.0 s
> Nov 29 16:00:55 hyperserver spamd[38942]: message: main message type: multipart/mixed
The child obviously is processing a message, and the child's last few
logged debug messages do not indicate any issue. Next is the parent
noticing its child's death.
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child closed connection
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child states: BIIIII
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: just exited
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: entering state 4
State 4, parent received SIGCHL.
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid: 38944
> Nov 29 16:00:55 hyperserver spamd[38925]: spamd: handled cleanup of child pid [38942] due to SIGCHLD: exit 1
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid: 38944
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: select returned err
> Interrupted system call, probably signalled
That would be due to the above sysread() failing. We backed down to
using select() and timeouts.
Wait, the code in question does ring some bells with the full thread in
mind. That debug message is unique in the SA code, and comes with a nice
explanation in M::SA::SpamdForkScaling:
if (exists &Errno::EINTR && $selerr == &Errno::EINTR)
{
# this happens if the process is signalled during the select(),
# for example if someone sends SIGHUP to reload the configuration.
# just return inmmediately
dbg("prefork: select returned err $selerr, probably signalled");
return;
}
Indeed, we did have to revert to select(). Might we also have received
SIGHUP to reload the configuration? Like, say, a massive whitelist being
updated, and us being requested to immediately pull it in? (Thanks
Martin Gregorie for pointing out that game of "whitelist changed, reload
daemon" procedure.)
Gino, are there any processes or cron jobs, that recreate the whitelist
more frequently than once a day? How frequently? Do they signal spamd
about the configuration change?
If so, you owe both me and Martin a beer. ;)
> Nov 29 16:00:55 hyperserver spamd[38925]: spamd: server successfully spawned child process, pid 39240
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 39240: entering state 0
State 0, a new child is born. Off to business as usual...
> If I just execute spamassassin -t -D from shell, most times there is no
> error and the message is fully scanned...
"MOST times there is no error". Emphasis mine. So you cannot reliably
reproduce the issue, and there is no test-case message. It just happens,
at random -- or rather at times other processes meddle with your spamd
daemon?
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Spamassassin Child is just dying without advise...
Posted by Gino Semseo <sp...@semseoymas.org>.
Hello Martin:
THANKS SO MUCH!!!
I have had modified your code, so being useful at my platform with
MySQL... also adding some code for wildcards, as *@domain.tld.
..... needed to cpan install and use Email::Address
.....
my ($mailaddr) = Email::Address->parse($aa);
my $dominio = $mailaddr->host;
$pms->{SENTwhitelist_senders} .= ' OR ' if
($pms->{SENTwhitelist_senders});
$pms->{SENTwhitelist_senders} .= "email = '$aa' OR email =
'*@".$dominio."'";
I will share the code and post it somehow or via answering this email..
At the moment, it is running perfectly!!! Thanks!
:)
---
--
Gino
semseoymas
El 2013-12-02 19:47, Martin Gregorie escribió:
> On Mon, 2013-12-02 at 14:34 +0100, Gino Semseo wrote:
>
>> PD: Martin, I am not an experienced programmer, and all I do is bash
>> scripting to get success about the whitelist_from file... I am sure
>> you
>> are true about programming a module doing this, but I cannot do it
>> right
>> now. ;)
>>
> My plugin was written by modifying one I found on the 'net: its
> reasonably documented and should be easy enough to modify. Its a Perl
> module that uses an SQL query to query a view in my mail archive, which
> is implemented as a PostgreSQL database. It looks up the message's
> sender to see if we've previously sent them any e-mails. If we have,
> the
> message gets whitelisted by the associated SA rule. The view makes the
> sender details appear like a single table to the plugin, so it should
> need minimal changes to work with your whitelist. Off the top of my
> head
> you'd need to do something like this:
>
> - rename all three files, plugin and rules to something meaningful
> for your installation
>
> - change the name of the table and the fields in it to match your
> database.
>
> - double check that the database has indexes that support
> this query or it may run very slowly. Copy the SQL query and
> run it by hand in an interactive SQL session to test that it works
> and that its fast enough.
>
> This is an important step due to differences between Postgres
> and mysql: Postgres speaks one of the most standards-compliant SQL
> dialects while mysql speaks one of the most non-standard dialects
> around. Hopefully this won't be a problem with such a simple query.
>
> - change the user/password/database name etc to match your
> installation
>
> Anybody with some knowledge of Perl and SQL should be able to help you
> get the plugin up and running.
>
> The files can be found here:
> http://www.libelle-systems.com/downloads/maplugin
>
>
> Martin
Re: Spamassassin Child is just dying without advise...
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2013-12-02 at 14:34 +0100, Gino Semseo wrote:
> PD: Martin, I am not an experienced programmer, and all I do is bash
> scripting to get success about the whitelist_from file... I am sure you
> are true about programming a module doing this, but I cannot do it right
> now. ;)
>
My plugin was written by modifying one I found on the 'net: its
reasonably documented and should be easy enough to modify. Its a Perl
module that uses an SQL query to query a view in my mail archive, which
is implemented as a PostgreSQL database. It looks up the message's
sender to see if we've previously sent them any e-mails. If we have, the
message gets whitelisted by the associated SA rule. The view makes the
sender details appear like a single table to the plugin, so it should
need minimal changes to work with your whitelist. Off the top of my head
you'd need to do something like this:
- rename all three files, plugin and rules to something meaningful
for your installation
- change the name of the table and the fields in it to match your
database.
- double check that the database has indexes that support
this query or it may run very slowly. Copy the SQL query and
run it by hand in an interactive SQL session to test that it works
and that its fast enough.
This is an important step due to differences between Postgres
and mysql: Postgres speaks one of the most standards-compliant SQL
dialects while mysql speaks one of the most non-standard dialects
around. Hopefully this won't be a problem with such a simple query.
- change the user/password/database name etc to match your
installation
Anybody with some knowledge of Perl and SQL should be able to help you
get the plugin up and running.
The files can be found here:
http://www.libelle-systems.com/downloads/maplugin
Martin
Re: Spamassassin Child is just dying without advise...
Posted by Gino Semseo <sp...@semseoymas.org>.
Finally:
Thanks so much! The problem was due to the memory resource limit
specified by Cpanel at local.cf..
>> > loadplugin Mail::SpamAssassin::Plugin::ResourceLimits
>> > resource_limit_mem 268435456
This limit never gave me problems, but now did. It was my fault not
giving attention to the very first lines of local.cf to just comment out
this lines... (facepalm)
Thanks so much!!!! To all of you!
PD: Martin, I am not an experienced programmer, and all I do is bash
scripting to get success about the whitelist_from file... I am sure you
are true about programming a module doing this, but I cannot do it right
now. ;)
---
--
Gino
semseoymas
>>
>> The whitelist is created every night from bash scripting and mysql
>> database... it contains the:
>> a) destinations from real emails sended from the server daily b)
>> emails whitelisted because users did include them...
>>
> WHY?
>
> It its probably more efficient to write a plugin to query the mysql
> database directly and will certainly eliminate the need to stop and
> restart SA each time a new version of the whitelist is creates and well
> as getting rid of the delay between adding a new address to the
> database
> and making the updated whitelist available to SA.
>
>
> Martin
Re: Spamassassin Child is just dying without advise...
Posted by Martin Gregorie <ma...@gregorie.org>.
On Sun, 2013-12-01 at 12:56 +0100, Gino Semseo wrote:
> > That's huge and rather excessive for whitelisting configuration. Are
> > there really 100k+ options, or does that include empty lines and
> > comments?
> >
>
> No... each line, is a mail address..
>
>
> > What conf does it contain: whitelist_* options, or other styles of
> > whitelisting?
>
> Do not understand your question... mmmm... the whitelist is just for
> "whitelist_from" values for SA... and included at local.cf...
>
> Now I have reduced to 127000 addresses, but I can tell you I were
> running almost 170000 rules without this problem time ago..
>
......
>
> The whitelist is created every night from bash scripting and mysql
> database... it contains the:
> a) destinations from real emails sended from the server daily b)
> emails whitelisted because users did include them...
>
WHY?
It its probably more efficient to write a plugin to query the mysql
database directly and will certainly eliminate the need to stop and
restart SA each time a new version of the whitelist is creates and well
as getting rid of the delay between adding a new address to the database
and making the updated whitelist available to SA.
Martin
Re: Spamassassin Child is just dying without advise...
Posted by Gino Semseo <sp...@semseoymas.org>.
Hello!!!
>> > loadplugin Mail::SpamAssassin::Plugin::ResourceLimits
>> > resource_limit_mem 268435456
>
> Why do you limit the available memory to 256 MB? Do you still see spamd
> children dieing with that plugin and limit commented out?
I am going to test, a) incrementing to 1024MB, b) disabling this
lines... ;)
> Fat-fingered copy-n-paste or editing? There is not really a line with a
> single zero in your conf, is it?
Yes... matter of copy/paste...... it is just at the same line... conf is
right, no problem with that ;)
>
>> > skip_rbl_checks 1
>
> You really do mean to disable (skip) RBL checks? Why?
Because I am executing rblchecks my way at EXIM ACLs.... executing twice
along with SA is not necessary... I have adjusted all my scores to my
situation.
>
>> > Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child states: BIIIII
>
> Something is fishy here. Given your explicit max-children 4 option,
> there should never be 6 children.
Have done several tests... I tried to set 10 max-children just to test,
with minimum-spare 8... but the same result.. the problem and the fact,
is the child is dying, doesnt matter the number of children spamd has
configured.
>
>> > # wc -l whitelistfile
>> > 127049 whitelistfile
>> > # du -hs whitelistfile
>> > 4,7M whitelistfile
>
> That's huge and rather excessive for whitelisting configuration. Are
> there really 100k+ options, or does that include empty lines and
> comments?
>
No... each line, is a mail address..
> What conf does it contain: whitelist_* options, or other styles of
> whitelisting?
Do not understand your question... mmmm... the whitelist is just for
"whitelist_from" values for SA... and included at local.cf...
Now I have reduced to 127000 addresses, but I can tell you I were
running almost 170000 rules without this problem time ago..
>
> Do you still see spamd children dieing without including that file, or
> at least drastically shortening it to the absolute necessary?
Not tested... I am trying first adjusting that memory limit from cpanel
at local.cf and if the problem continues, will quit temporaly this
whitelist to see..
The whitelist is created every night from bash scripting and mysql
database... it contains the:
a) destinations from real emails sended from the server daily b)
emails whitelisted because users did include them...
Each registry has a expiration date at mysql, so the whitelist is
created dynamically..
THANKS SO MUCH.. will answer soon.
Re: Spamassassin Child is just dying without advise...
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sat, 2013-11-30 at 20:43 +0100, Axb wrote:
> On 11/30/2013 08:27 PM, Gino Semseo wrote:
> > This is the launch command:
> > usr/local/cpanel/3rdparty/perl/514/bin/spamd -d --allowed-ips=127.0.0.1
> > --max-conn-per-child=200 --pidfile=/var/run/spamd.pid --max-children=4
> >
> > This is the spamassassin.conf
> >
> > loadplugin Mail::SpamAssassin::Plugin::ResourceLimits
> > resource_limit_mem 268435456
That is not provided by SA.
Why do you limit the available memory to 256 MB? Do you still see spamd
children dieing with that plugin and limit commented out?
> > include /etc/mail/spamassassin/whitelistfile
> > ######## ... ########use_auto_whitelist
> > 0
Fat-fingered copy-n-paste or editing? There is not really a line with a
single zero in your conf, is it?
> > skip_rbl_checks 1
You really do mean to disable (skip) RBL checks? Why?
> > Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child states: BIIIII
Something is fishy here. Given your explicit max-children 4 option,
there should never be 6 children.
> > # wc -l whitelistfile
> > 127049 whitelistfile
> > # du -hs whitelistfile
> > 4,7M whitelistfile
That's huge and rather excessive for whitelisting configuration. Are
there really 100k+ options, or does that include empty lines and
comments?
What conf does it contain: whitelist_* options, or other styles of
whitelisting?
Do you still see spamd children dieing without including that file, or
at least drastically shortening it to the absolute necessary?
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Spamassassin Child is just dying without advise...
Posted by Axb <ax...@gmail.com>.
On 11/30/2013 08:27 PM, Gino Semseo wrote:
> Hello:
>
> I am the hoster ;)
>
> This is the launch command:
> usr/local/cpanel/3rdparty/perl/514/bin/spamd -d --allowed-ips=127.0.0.1
> --max-conn-per-child=200 --pidfile=/var/run/spamd.pid --max-children=4
>
> This is the spamassassin.conf
>
> loadplugin Mail::SpamAssassin::Plugin::ResourceLimits
> resource_limit_mem 268435456
> ##########################################################################################################
>
> allow_user_rules 0
> ##########################################################################################################
>
> include /etc/mail/spamassassin/whitelistfile
> ##########################################################################################################
>
> required_score 5.5
> ##########################################################################################################
>
> # DCC
> use_dcc 1
> dcc_home /var/dcc
> dcc_path /usr/bin/dccproc
> dcc_timeout 10
> dcc_body_max 30
> dcc_fuz1_max 30
> dcc_fuz2_max 40
> score DCC_CHECK 60
> ##########################################################################################################
>
> # RAZOR
> use_razor2 1
> razor_config /var/razor/razor-agent.conf
> score RAZOR2_CHECK 60
> ##########################################################################################################
>
> bayes_path /etc/mail/spamassassin/bayes/bayes
> bayes_file_mode 0777
> use_bayes 1
> bayes_auto_learn 1
> bayes_auto_expire 0
> bayes_use_hapaxes 1
> bayes_journal_max_size 100000
> bayes_expiry_max_db_size 3600000
> bayes_learn_to_journal 1
> bayes_auto_learn_threshold_spam 30
> bayes_auto_learn_threshold_nonspam 1
> #required_hits 3.5
> #######################################################################################################use_auto_whitelist
> 0
> #auto_whitelist_factor 0.5
> #auto_whitelist_path /etc/mail/spamassassin/awl/auto-whitelist
> #auto_whitelist_file_mode 0777
> ##########################################################################################################
>
> skip_rbl_checks 1
> ##########################################################################################################
>
> ##########################################################################################################
>
> score BAYES_00 0
> score BAYES_05 0
> score BAYES_20 1.6
> score BAYES_40 2.0
> score BAYES_50 2.3
> score BAYES_60 2.5
> score BAYES_80 4
> score BAYES_95 6
> score BAYES_99 7
> score FROM_EXCESS_BASE64 2
> score SUBJ_ALL_CAPS 0.6
> score RP_MATCHES_RCVD 0
> score HTML_IMAGE_ONLY_08 1.4
> score URIBL_GREY 2.5
> score URIBL_BLACK 4.5
> score URIBL_JP_SURBL 3.5
> score URIBL_DBL_SPAM 4
> score DIET_1 0.8
> score HTML_SHORT_LINK_IMG_2 1
> score DEAR_SOMETHING 1
> score MISSING_SUBJECT 1
> score FSL_HELO_BARE_IP_2 1
> score HTML_FONT_SIZE_HUGE 2
> score FREEMAIL_ENVFROM_END_DIGIT 0
> score FSL_CTYPE_WIN1251 4
> score FORGED_OUTLOOK_TAGS 2
> score FREEMAIL_FORGED_REPLYTO 2
> score FREEMAIL_REPLYTO 3
> score FORGED_MUA_OUTLOOK 3.5
> score DEAR_SOMETHING 2.5
> score DRUGS_ERECTILE 2
> score DRUGS_ERECTILE_OBFU 2
> score DRUG_ED_CAPS 2.5
> score KAM_VIAGRA1 2.5
> score KAM_VIAGRA5 2.5
> score KAM_VIAGRA6 2.5
> #################################################################################################################################################################################################################
>
> # DESHABILITAR ANALISIS DE ESTOS HEADERS AL FILTRO BAYESIANO
> ##########################################################################################################
>
> bayes_ignore_header X-Bogosity
> bayes_ignore_header X-Spam-Flag
> bayes_ignore_header X-Spam-Status
> bayes_ignore_header X-Spam-Report
> ##########################################################################################################
>
> ##########################################################################################################
>
>
>
> Spamd is using suexec to execute spamassassin.... most of the time is
> fine, some others the proccess die do not know why, at different points...
>
> It is not a question of Exim, just forwarding emails to spamd.... not
> above 200Kb..... is just a question of spamd (with -D) logging:
>
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child closed
> connection
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child states: BIIIII
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child 34429: just
> exited
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child 34429: entering
> state 4
> Nov 29 15:52:28 hyperserver spamd[34416]: spamd: handled cleanup of
> child pid [34429] due to SIGCHLD: exit 1
>
> at different points...
>
> I thought first on memory available... but ulimit -a for root/users
> shows no memory problem:
>
> sudo -u semseoes -H bash -c "ulimit -a"
> core file size (blocks, -c) 400000
> data seg size (kbytes, -d) 400000
> scheduling priority (-e) 0
> file size (blocks, -f) unlimited
> pending signals (-i) 255627
> max locked memory (kbytes, -l) 64
> max memory size (kbytes, -m) unlimited
> open files (-n) 16000
> pipe size (512 bytes, -p) 8
> POSIX message queues (bytes, -q) 819200
> real-time priority (-r) 0
> stack size (kbytes, -s) 8192
> cpu time (seconds, -t) unlimited
> max user processes (-u) 110
> virtual memory (kbytes, -v) unlimited
> file locks (-x) unlimited
>
>
> This is just the same for all users... and above kernel at sysctl.conf:
>
> kernel.sysrq=0
> fs.inotify.max_user_watches=65536
> fs.inotify.max_queued_events=65536
> kernel.core_uses_pid=1
> kernel.pid_max=65536
> fs.file-max=5000000
> kernel.shmmax=68719476736
> kernel.shmall=4294967296
> #kernel.shmmax=1073741824
> #kernel.shmall=3774873
> kernel.sem=250 256000 32 1024
> kernel.msgmax=65535
> kernel.msgmnb=65535
> vm.swappiness=1
> vm.vfs_cache_pressure=50
>
>
> The server has 32Gb of RAM and is 0.x LOAD most of the time!
>
> free
> total used free shared buffers cached
> Mem: 32737940 31507400 1230540 0 407284 9139196
> -/+ buffers/cache: 21960920 10777020
> Swap: 16777208 0 16777208
>
>
> And the problem goes on....
>
> The bayes:
>
> ll -h
> total 72M
> -rw-rw-rw- 1 cpanel cpanel 83K nov 30 20:19 bayes_journal
> -rwxrwxrwx 1 root root 10M nov 30 20:06 bayes_seen
> -rwxrwxrwx 1 root root 77M nov 30 20:06 bayes_toks
>
> The whitelist:
>
> # wc -l whitelistfile
> 127049 whitelistfile
> # du -hs whitelistfile
> 4,7M whitelistfile
>
>
> The big problem:
>
> # grep "due to SIGCHLD" maillog | wc -l
> 14227
>
> 2013-11-30 13:07:18 1VmjKP-0001O5-6O spam acl condition: cannot parse
> spamd output
> 2013-11-30 13:22:48 1VmjZP-0002s9-MV spam acl condition: cannot parse
> spamd output
> 2013-11-30 13:26:49 1VmjdI-0003EA-QV spam acl condition: cannot parse
> spamd output
> 2013-11-30 13:44:48 1Vmjue-0004y2-Tt spam acl condition: cannot parse
> spamd output
> 2013-11-30 14:08:48 1VmkHt-0007QV-5T spam acl condition: cannot parse
> spamd output
> 2013-11-30 15:08:39 1VmlDq-000Cpv-Ou spam acl condition: cannot parse
> spamd output
> 2013-11-30 15:10:01 1VmlF9-000Cvn-GX spam acl condition: cannot parse
> spamd output
> 2013-11-30 16:27:47 1VmmSP-0003CQ-Ee spam acl condition: cannot parse
> spamd output
> 2013-11-30 16:54:31 1VmmsI-0005Z2-G4 spam acl condition: cannot parse
> spamd output
> 2013-11-30 18:30:27 1VmoN3-000EU6-Pp spam acl condition: cannot parse
> spamd output
> 2013-11-30 18:44:40 1Vmoat-000Fl0-Sk spam acl condition: cannot parse
> spamd output
> 2013-11-30 20:05:03 1Vmpqe-0005bN-PY spam acl condition: cannot parse
> spamd output
>
>
> Other example: the last fail at exim_mainlog
>
> Nov 30 20:05:03 hyperserver spamd[20097]: spamd: connection from
> localhost [127.0.0.1] at port 36073
> Nov 30 20:05:03 hyperserver spamd[20097]: spamd: setuid to cuerposp
> succeeded
> Nov 30 20:05:03 hyperserver spamd[20092]: prefork: child states: BI
> Nov 30 20:05:03 hyperserver spamd[20092]: spamd: handled cleanup of
> child pid [20097] due to SIGCHLD: exit 1
> Nov 30 20:05:03 hyperserver spamd[20092]: spamd: server successfully
> spawned child process, pid 21738
> Nov 30 20:05:03 hyperserver spamd[20092]: prefork: child states: II
>
> Look what happens to child spamassassin proccess 20097....... ;)
>
> Now I have -D disabled at spamd, but I can activate...
>
> Could someone help me?? I can debug or show you the data you ask for
> without problems...
Please keep list mail on the list.
This is not supplied by SA - I suppose it's some Cpanel special
loadplugin Mail::SpamAssassin::Plugin::ResourceLimits
No idea why one may need that.
You run spamd with --max-children=4
On a busy box, I'd increase that to 30 and add --min-spare=5
Re: Spamassassin Child is just dying without advise...
Posted by Axb <ax...@gmail.com>.
On 11/29/2013 11:13 PM, Gino Semseo wrote:
> Hello:
>
> I need some support here, since I am getting crazy.... not always, but
> often, SA childs die without advise during proccesing of an email...
> Exim then just receive something like:
>
> 2013-11-29 20:29:01 1VmTkL-0002F8-5Q spam acl condition: cannot parse
> spamd output
>
> These are some logs...
>
> /usr/local/cpanel/3rdparty/perl/514/bin/spamassassin -V
> SpamAssassin version 3.3.2
> running on Perl version 5.14.3
>
> I have started spamd with -D for debugging:
>
> Then...
>
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: ordered 38942 to accept
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: sysread(7) not ready,
> wait max 300 secs
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: entering
> state 2
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
> 38944
> Nov 29 16:00:55 hyperserver spamd[38942]: spamd: connection from
> localhost [127.0.0.1] at port 44846
> Nov 29 16:00:55 hyperserver spamd[38942]: spamd: setuid to diversia
> succeeded
> Nov 29 16:00:55 hyperserver spamd[38942]: config: read_scoreonly_config:
> cannot open "/home/diversia/.spamassassin/user_prefs": No such file or
> directory
> Nov 29 16:00:55 hyperserver spamd[38942]: info: user has changed
> Nov 29 16:00:55 hyperserver spamd[38942]: bayes: learner_new
> self=Mail::SpamAssassin::Plugin::Bayes=HASH(0x3ac68d0),
> bayes_store_module=Mail::SpamAssassin::$
> Nov 29 16:00:55 hyperserver spamd[38942]: bayes: learner_new: got
> store=Mail::SpamAssassin::BayesStore::DBM=HASH(0x5765450)
> Nov 29 16:00:55 hyperserver spamd[38942]: bayes: tie-ing to DB file R/O
> /etc/mail/spamassassin/bayes/bayes_toks
> Nov 29 16:00:55 hyperserver spamd[38942]: bayes: tie-ing to DB file R/O
> /etc/mail/spamassassin/bayes/bayes_seen
> Nov 29 16:00:55 hyperserver spamd[38942]: bayes: found bayes db version 3
> Nov 29 16:00:55 hyperserver spamd[38942]: bayes: DB journal sync: last
> sync: 1385736975
> Nov 29 16:00:55 hyperserver spamd[38942]: config: score set 3 chosen.
> Nov 29 16:00:55 hyperserver spamd[38942]: spamd: running as uid 574
> Nov 29 16:00:55 hyperserver spamd[38942]: config: time limit 300.0 s
> Nov 29 16:00:55 hyperserver spamd[38942]: message: main message type:
> multipart/mixed
> ...
> ...
> ...
> ...
> etc
> ...
> ...
> ...
> ...
> etc
> ...
> ...
> ...
> Nov 29 16:00:55 hyperserver spamd[38942]: FreeMail: RULE (FREEMAIL_FROM)
> check_freemail_from
> Nov 29 16:00:55 hyperserver spamd[38942]: FreeMail: all from-addresses:
> rcopero@vivagym.es
> Nov 29 16:00:55 hyperserver spamd[38942]: spf: checking to see if the
> message has a Received-SPF header that we can use
> Nov 29 16:00:55 hyperserver spamd[38942]: spf: checking HELO
> (helo=mail-vb0-f48.google.com, ip=209.85.212.48)
> Nov 29 16:00:55 hyperserver spamd[38942]: dns: providing a callback for
> id: 34562/mail-vb0-f48.google.com/SPF/IN
> Nov 29 16:00:55 hyperserver spamd[38942]: dns: providing a callback for
> id: 8678/mail-vb0-f48.google.com/TXT/IN
> Nov 29 16:00:55 hyperserver spamd[38942]: spf: query for
> /209.85.212.48/mail-vb0-f48.google.com: result: none, comment: , text:
> No applicable sender policy available
> Nov 29 16:00:55 hyperserver spamd[38942]: spf: already checked for
> Received-SPF headers, proceeding with DNS based checks
> Nov 29 16:00:55 hyperserver spamd[38942]: spf: found Envelope-From in
> first external Received header
> Nov 29 16:00:55 hyperserver spamd[38942]: spf: checking EnvelopeFrom
> (helo=mail-vb0-f48.google.com, ip=209.85.212.48,
> envfrom=rcopero@vivagym.es)
> Nov 29 16:00:55 hyperserver spamd[38942]: dns: providing a callback for
> id: 21188/vivagym.es/SPF/IN
> Nov 29 16:00:55 hyperserver spamd[38942]: dns: providing a callback for
> id: 44168/vivagym.es/TXT/IN
> Nov 29 16:00:55 hyperserver spamd[38942]: spf: query for
> rcopero@vivagym.es/209.85.212.48/mail-vb0-f48.google.com: result: none,
> comment: , text: No applicable sender policy available
> Nov 29 16:00:55 hyperserver spamd[38942]: FreeMail: RULE
> (__freemail_reply) check_freemail_replyto
> Nov 29 16:00:55 hyperserver spamd[38942]: FreeMail: From address:
> rcopero@vivagym.es
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child closed connection
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child states: BIIIII
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: just exited
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 38942: entering
> state 4
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
> 38944
> Nov 29 16:00:55 hyperserver spamd[38925]: spamd: handled cleanup of
> child pid [38942] due to SIGCHLD: exit 1
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
> 38944
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: select returned err
> Interrupted system call, probably signalled
> Nov 29 16:00:55 hyperserver spamd[38925]: spamd: server successfully
> spawned child process, pid 39240
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 39240: entering
> state 0
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
> 38944
> Nov 29 16:00:55 hyperserver spamd[39240]: plugin:
> Mail::SpamAssassin::Plugin::ResourceLimits=HASH(0x3f9b328) implements
> 'spamd_child_init', priority 0
> Nov 29 16:00:55 hyperserver spamd[39240]: resourcelimitplugin: In
> spamd_child_init
> Nov 29 16:00:55 hyperserver spamd[39240]: resourcelimitplugin: cpu limit: 0
> Nov 29 16:00:55 hyperserver spamd[39240]: resourcelimitplugin: mem
> limit: 268435456
> Nov 29 16:00:55 hyperserver spamd[39240]: prefork: sysread(12) not
> ready, wait max 300 secs
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child 39240: entering
> state 1
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: new lowest idle kid:
> 38944
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child reports idle
> Nov 29 16:00:55 hyperserver spamd[38925]: prefork: child states: IIIIII
>
>
> Bang! As you may see, the child just went out directly, as "prefork:
> child closed connection" and "prefork: child 38942: just exited"...
>
> Not always at the same point... by example, other one:
>
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running rawbody tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running full tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running meta tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: check: running tests for
> priority: -900
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running one_line_body
> tests; score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running head tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running head_eval
> tests; score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: run_eval_tests -
> compiling eval code: 9, priority -900
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running body tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running uri tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running body_eval
> tests; score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: run_eval_tests -
> compiling eval code: 11, priority -900
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running rawbody tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running full tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: rules: running meta tests;
> score so far=-100
> Nov 29 15:52:28 hyperserver spamd[34429]: check: running tests for
> priority: -400
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child closed connection
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child states: BIIIII
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child 34429: just exited
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: child 34429: entering
> state 4
> Nov 29 15:52:28 hyperserver spamd[34416]: prefork: new lowest idle kid:
> 34430
> Nov 29 15:52:28 hyperserver spamd[34416]: spamd: handled cleanup of
> child pid [34429] due to SIGCHLD: exit 1
>
>
> I do not know what to do...
>
> If I just execute spamassassin -t -D from shell, most times there is no
> error and the message is fully scanned...
>
>
> Could someone help me?
As you haven't provided much info as to what parameters you use to run
spamd, what glue is being used by Exim, OS, resources, etc. and assuming
this is a Cpanel box provided by your hoster, for fast "support" you may
be better off contacting your hosting support or a Cpanel forum.