You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by gable <ro...@globet.com> on 2007/03/11 23:40:56 UTC
Re: [2] protocol error in spamassassin
gable wrote:
>
> Hiya
>
> Has anyone come across error like these before - spamassassin was working
> perfect - but a couple of days ago - we got flooded with spam. Checking
> the logs ... errors like the one below come up 25,000 times :-) ... The
> only solution i've found to work is to keep restarting spamd on a crond
> ... a temporary fix ..
>
> Sun Mar 11 15:46:15 2007 [26282] info: spamd: connection from
> mxr1duk.xxxxx.com [127.0.0.1] at port 36877
> Sun Mar 11 15:46:15 2007 [26282] warn: spamd: bad protocol: header error:
> (closed before headers) at /usr/bin/spamd line 1671.
> Sun Mar 11 15:46:15 2007 [26280] info: prefork: child states: II
> Sun Mar 11 15:46:20 2007 [26282] info: spamd: connection from
> mxr1duk.xxxxx.com [127.0.0.1] at port 36878
> Sun Mar 11 15:46:20 2007 [26282] warn: spamd: bad protocol: header error:
> (closed before headers) at /usr/bin/spamd line 1671.
> Sun Mar 11 15:46:20 2007 [26280] info: prefork: child states: II
> Sun Mar 11 15:46:25 2007 [26282] info: spamd: connection from
> mxr1duk.xxxxx.com [127.0.0.1] at port 36879
> Sun Mar 11 15:46:25 2007 [26282] warn: spamd: bad protocol: header error:
> (closed before headers) at /usr/bin/spamd line 1671.
> Sun Mar 11 15:46:25 2007 [26280] info: prefork: child states: II
> Sun Mar 11 15:46:31 2007 [26282] info: spamd: connection from
> mxr1duk.xxxxx.com [127.0.0.1] at port 36880
> Sun Mar 11 15:46:31 2007 [26282] warn: spamd: bad protocol: header error:
> (closed before headers) at /usr/bin/spamd line 1671.
> Sun Mar 11 15:46:31 2007 [26280] info: prefork: child states: II
>
>
> any assistance would be much appreciated
>
> Cheers ...
>
>
A little more information .. apologizes ... I'm running postfix ..
spamassassin 3.1.8-2.fc6 ... the spamd daemon is called from postfix via the
follow script
#!/bin/sh
SENDMAIL="/usr/lib/sendmail.postfix -i"
SPAMASSASSIN=/usr/bin/spamc
# Exit codes from <sysexits.h>
EX_TEMPFAIL=75
EX_UNAVAILABLE=69
umask 077
OUTPUT="`mktemp /tmp/mailfilter.XXXXXXXXXX`"
if [ "$?" != 0 ]; then
/usr/bin/logger -s -p mail.warning -t filter \
"Unable to create temporary file."
exit $EX_TEMPFAIL
fi
# Clean up when done or when aborting.
trap "rm -f $OUTPUT" EXIT SIGTERM
$SPAMASSASSIN -x > $OUTPUT
return="$?"
if [ "$return" == 1 ]; then
echo "Message content rejected"
exit $EX_UNAVAILABLE
elif [ "$return" != 0 ]; then
/usr/bin/logger -s -p mail.warning -t filter \
"Temporary SpamAssassin failure (spamc return $return)"
exit $EX_TEMPFAIL
fi
$SENDMAIL "$@" < $OUTPUT
exit $?
I'm pretty sure its something i've done wrong ... the same error started on
both relays ... a minute apart from one another - no manual/automatic
installl's happened (yum.log) ... and the configs and exactly as they were
before ... nothing has really be changed .. *rolling eyes* :) ..
--
View this message in context: http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9425778
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: [2] protocol error in spamassassin
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Sun, 11 Mar 2007, gable wrote:
>
>
> we have monitoring in place .. zabbix in this case .. The process isn't
> dying, tailing the logs .. and checking processes .. the spamd process is up
> and running ... but the connection between spamc and the daemon isn't
> talking correctly .... A fellow sysadmi seems to think it's something to do
> with IO::Handle perl module ...they had the exact same errors .... and
> blamed it on that!
>
>
> Justin Mason wrote:
> >
> >
> > that's the error message produced when the connection is closed
> > before any data is sent. Have you got an nmap running every 5
> > minutes? or some kind of keep-alive daemon checking to see if
> > spamd is running?
Can you program your 'zabbix' to hold a conversation with spamd?
The best way to check to make sure that spamd is alive would be to
do a 'PING' check. Have zabbix send the command "PING SPAMC/1.1"
and look for the "SPAMD/1.2 0 PONG" response.
EG:
% telnet spamd.host 783
Trying...
Connected to spamd.host
Escape character is '^]'.
PING SPAMC/1.1
SPAMD/1.2 0 PONG
Connection closed by foreign host.
quick check and no barking by spamd in the logs.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: [2] protocol error in spamassassin
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
gable wrote:
>
> Yes! ... i now officially feel like a moron :-) ... yr right ... zabbix
> makes a tcp connection to port 783 to check it's running ... switching
> monitoring on and off ... switches the error on and off ... I'll look for
> the spamd process instead as a monitoring means ... I guees the fact the
> event correlated with a flood of spam getting through - made me chase for
> bigger issues' ... but hey ..
My check_spamd Nagios plugin may work for you if zabbix can use a
command line tool (and check it's return value) for monitoring.
check_spamd connects to spamd as a client as issues a ping command to
verify that spamd isn't running but unresponsive.
It's available here:
http://svn.apache.org/viewvc/spamassassin/trunk/contrib/check_spamd
Daryl
Re: [2] protocol error in spamassassin
Posted by gable <ro...@globet.com>.
Yes! ... i now officially feel like a moron :-) ... yr right ... zabbix
makes a tcp connection to port 783 to check it's running ... switching
monitoring on and off ... switches the error on and off ... I'll look for
the spamd process instead as a monitoring means ... I guees the fact the
event correlated with a flood of spam getting through - made me chase for
bigger issues' ... but hey ..
thank you kindly for the help :-) ..
Justin Mason wrote:
>
>
> I think you misunderstand. the error message is entirely normal and not
> indicative of a bug. it's produced when something (such as monitoring
> software!) opens a TCP connection to the spamd port, then closes it again.
>
> --j.
>
> gable writes:
>> we have monitoring in place .. zabbix in this case .. The process isn't
>> dying, tailing the logs .. and checking processes .. the spamd process is
>> up
>> and running ... but the connection between spamc and the daemon isn't
>> talking correctly .... A fellow sysadmi seems to think it's something to
>> do
>> with IO::Handle perl module ...they had the exact same errors .... and
>> blamed it on that!
>>
>>
>> Justin Mason wrote:
>> >
>> >
>> > that's the error message produced when the connection is closed
>> > before any data is sent. Have you got an nmap running every 5
>> > minutes? or some kind of keep-alive daemon checking to see if
>> > spamd is running?
>> >
>> > --j.
>> >
>> > gable writes:
>> >> gable wrote:
>> >> >
>> >> > Hiya
>> >> >
>> >> > Has anyone come across error like these before - spamassassin was
>> >> working
>> >> > perfect - but a couple of days ago - we got flooded with spam.
>> Checking
>> >> > the logs ... errors like the one below come up 25,000 times :-) ...
>> The
>> >> > only solution i've found to work is to keep restarting spamd on a
>> crond
>> >> > ... a temporary fix ..
>> >> >
>> >> > Sun Mar 11 15:46:15 2007 [26282] info: spamd: connection from
>> >> > mxr1duk.xxxxx.com [127.0.0.1] at port 36877
>> >> > Sun Mar 11 15:46:15 2007 [26282] warn: spamd: bad protocol: header
>> >> error:
>> >> > (closed before headers) at /usr/bin/spamd line 1671.
>> >> > Sun Mar 11 15:46:15 2007 [26280] info: prefork: child states: II
>> >> > Sun Mar 11 15:46:20 2007 [26282] info: spamd: connection from
>> >> > mxr1duk.xxxxx.com [127.0.0.1] at port 36878
>> >> > Sun Mar 11 15:46:20 2007 [26282] warn: spamd: bad protocol: header
>> >> error:
>> >> > (closed before headers) at /usr/bin/spamd line 1671.
>> >> > Sun Mar 11 15:46:20 2007 [26280] info: prefork: child states: II
>> >> > Sun Mar 11 15:46:25 2007 [26282] info: spamd: connection from
>> >> > mxr1duk.xxxxx.com [127.0.0.1] at port 36879
>> >> > Sun Mar 11 15:46:25 2007 [26282] warn: spamd: bad protocol: header
>> >> error:
>> >> > (closed before headers) at /usr/bin/spamd line 1671.
>> >> > Sun Mar 11 15:46:25 2007 [26280] info: prefork: child states: II
>> >> > Sun Mar 11 15:46:31 2007 [26282] info: spamd: connection from
>> >> > mxr1duk.xxxxx.com [127.0.0.1] at port 36880
>> >> > Sun Mar 11 15:46:31 2007 [26282] warn: spamd: bad protocol: header
>> >> error:
>> >> > (closed before headers) at /usr/bin/spamd line 1671.
>> >> > Sun Mar 11 15:46:31 2007 [26280] info: prefork: child states: II
>> >> >
>> >> >
>> >> > any assistance would be much appreciated
>> >> >
>> >> > Cheers ...
>> >> >
>> >> >
>> >>
>> >> A little more information .. apologizes ... I'm running postfix ..
>> >> spamassassin 3.1.8-2.fc6 ... the spamd daemon is called from postfix
>> via
>> >> the
>> >> follow script
>> >>
>> >> #!/bin/sh
>> >> SENDMAIL="/usr/lib/sendmail.postfix -i"
>> >> SPAMASSASSIN=/usr/bin/spamc
>> >>
>> >> # Exit codes from <sysexits.h>
>> >> EX_TEMPFAIL=75
>> >> EX_UNAVAILABLE=69
>> >>
>> >> umask 077
>> >>
>> >> OUTPUT="`mktemp /tmp/mailfilter.XXXXXXXXXX`"
>> >> if [ "$?" != 0 ]; then
>> >> /usr/bin/logger -s -p mail.warning -t filter \
>> >> "Unable to create temporary file."
>> >> exit $EX_TEMPFAIL
>> >> fi
>> >>
>> >> # Clean up when done or when aborting.
>> >> trap "rm -f $OUTPUT" EXIT SIGTERM
>> >>
>> >> $SPAMASSASSIN -x > $OUTPUT
>> >> return="$?"
>> >> if [ "$return" == 1 ]; then
>> >> echo "Message content rejected"
>> >> exit $EX_UNAVAILABLE
>> >> elif [ "$return" != 0 ]; then
>> >> /usr/bin/logger -s -p mail.warning -t filter \
>> >> "Temporary SpamAssassin failure (spamc return $return)"
>> >> exit $EX_TEMPFAIL
>> >> fi
>> >>
>> >> $SENDMAIL "$@" < $OUTPUT
>> >> exit $?
>> >>
>> >> I'm pretty sure its something i've done wrong ... the same error
>> started
>> >> on
>> >> both relays ... a minute apart from one another - no manual/automatic
>> >> installl's happened (yum.log) ... and the configs and exactly as they
>> >> were
>> >> before ... nothing has really be changed .. *rolling eyes* :) ..
>> >>
>> >>
>> >>
>> >>
>> >> --
>> >> View this message in context:
>> >>
>> http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9425778
>> >> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>> >
>> >
>>
>> --
>> View this message in context:
>> http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9426266
>> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>
>
--
View this message in context: http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9431646
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: [2] protocol error in spamassassin
Posted by gable <ro...@globet.com>.
we have monitoring in place .. zabbix in this case .. The process isn't
dying, tailing the logs .. and checking processes .. the spamd process is up
and running ... but the connection between spamc and the daemon isn't
talking correctly .... A fellow sysadmi seems to think it's something to do
with IO::Handle perl module ...they had the exact same errors .... and
blamed it on that!
Justin Mason wrote:
>
>
> that's the error message produced when the connection is closed
> before any data is sent. Have you got an nmap running every 5
> minutes? or some kind of keep-alive daemon checking to see if
> spamd is running?
>
> --j.
>
> gable writes:
>> gable wrote:
>> >
>> > Hiya
>> >
>> > Has anyone come across error like these before - spamassassin was
>> working
>> > perfect - but a couple of days ago - we got flooded with spam. Checking
>> > the logs ... errors like the one below come up 25,000 times :-) ... The
>> > only solution i've found to work is to keep restarting spamd on a crond
>> > ... a temporary fix ..
>> >
>> > Sun Mar 11 15:46:15 2007 [26282] info: spamd: connection from
>> > mxr1duk.xxxxx.com [127.0.0.1] at port 36877
>> > Sun Mar 11 15:46:15 2007 [26282] warn: spamd: bad protocol: header
>> error:
>> > (closed before headers) at /usr/bin/spamd line 1671.
>> > Sun Mar 11 15:46:15 2007 [26280] info: prefork: child states: II
>> > Sun Mar 11 15:46:20 2007 [26282] info: spamd: connection from
>> > mxr1duk.xxxxx.com [127.0.0.1] at port 36878
>> > Sun Mar 11 15:46:20 2007 [26282] warn: spamd: bad protocol: header
>> error:
>> > (closed before headers) at /usr/bin/spamd line 1671.
>> > Sun Mar 11 15:46:20 2007 [26280] info: prefork: child states: II
>> > Sun Mar 11 15:46:25 2007 [26282] info: spamd: connection from
>> > mxr1duk.xxxxx.com [127.0.0.1] at port 36879
>> > Sun Mar 11 15:46:25 2007 [26282] warn: spamd: bad protocol: header
>> error:
>> > (closed before headers) at /usr/bin/spamd line 1671.
>> > Sun Mar 11 15:46:25 2007 [26280] info: prefork: child states: II
>> > Sun Mar 11 15:46:31 2007 [26282] info: spamd: connection from
>> > mxr1duk.xxxxx.com [127.0.0.1] at port 36880
>> > Sun Mar 11 15:46:31 2007 [26282] warn: spamd: bad protocol: header
>> error:
>> > (closed before headers) at /usr/bin/spamd line 1671.
>> > Sun Mar 11 15:46:31 2007 [26280] info: prefork: child states: II
>> >
>> >
>> > any assistance would be much appreciated
>> >
>> > Cheers ...
>> >
>> >
>>
>> A little more information .. apologizes ... I'm running postfix ..
>> spamassassin 3.1.8-2.fc6 ... the spamd daemon is called from postfix via
>> the
>> follow script
>>
>> #!/bin/sh
>> SENDMAIL="/usr/lib/sendmail.postfix -i"
>> SPAMASSASSIN=/usr/bin/spamc
>>
>> # Exit codes from <sysexits.h>
>> EX_TEMPFAIL=75
>> EX_UNAVAILABLE=69
>>
>> umask 077
>>
>> OUTPUT="`mktemp /tmp/mailfilter.XXXXXXXXXX`"
>> if [ "$?" != 0 ]; then
>> /usr/bin/logger -s -p mail.warning -t filter \
>> "Unable to create temporary file."
>> exit $EX_TEMPFAIL
>> fi
>>
>> # Clean up when done or when aborting.
>> trap "rm -f $OUTPUT" EXIT SIGTERM
>>
>> $SPAMASSASSIN -x > $OUTPUT
>> return="$?"
>> if [ "$return" == 1 ]; then
>> echo "Message content rejected"
>> exit $EX_UNAVAILABLE
>> elif [ "$return" != 0 ]; then
>> /usr/bin/logger -s -p mail.warning -t filter \
>> "Temporary SpamAssassin failure (spamc return $return)"
>> exit $EX_TEMPFAIL
>> fi
>>
>> $SENDMAIL "$@" < $OUTPUT
>> exit $?
>>
>> I'm pretty sure its something i've done wrong ... the same error started
>> on
>> both relays ... a minute apart from one another - no manual/automatic
>> installl's happened (yum.log) ... and the configs and exactly as they
>> were
>> before ... nothing has really be changed .. *rolling eyes* :) ..
>>
>>
>>
>>
>> --
>> View this message in context:
>> http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9425778
>> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>
>
--
View this message in context: http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9426266
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.