You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "parakrama55 ." <pa...@gmail.com> on 2014/02/21 14:54:53 UTC
Spamassassin Timeout error
Hi
we are getting follwing errors in the logs,
2014-02-21 05:50:27 1WGqSi-0003d7-Pi spam acl condition: error reading from
spamd socket: Connection timed out
2014-02-21 05:50:27 1WGqSi-0003dD-9p spam acl condition: error reading from
spamd socket: Connection timed out
Seems like because of this mail server ignore spamassain check
Is there any reason for that , Please advice how to fix this issue
Thanks
Re: Spamassassin Timeout error
Posted by "parakrama55 ." <pa...@gmail.com>.
also in the message header i can see the following information getting
added
X-SA-Exim-Connect-IP: 10.100.2.1
X-SA-Exim-Mail-From: users-bounces@ihk.org
X-SA-Exim-Scanned: No (on mail.ihk.org); SAEximRunCond expanded to false
On 22 February 2014 03:58, parakrama55 . <pa...@gmail.com> wrote:
> Hi guys
>
> Spmd parameters
> ==============
>
> ps auxwwww | grep spamd
> root 6679 0.3 1.3 130064 66940 ? Ss 13:45 0:07
> /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s
> /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid
> 102 8747 82.5 1.4 136320 73632 ? R 14:22 2:23 spamd
> child
> nobody 8754 85.8 1.4 136228 73600 ? R 14:22 2:23 spamd
> child
> nobody 8772 87.6 1.4 135980 73388 ? R 14:22 2:07 spamd
> child
> 102 8814 84.2 1.4 136052 73368 ? D 14:23 1:41 spamd
> child
> root 8979 0.0 0.0 6032 720 pts/0 S+ 14:25 0:00 grep spamd
>
>
>
> 1. If it is not happening on all messages, how large are the messages it
> is happening on?
>
> Yes now its happen for the all the messages
>
> 2. Can you check your SA logs and see what the average scan times look
> like?
>
> Scan time varis beteen 1 - 20 seconds
>
> 3 .Do you know how to change the timeout in the SA glue?
> No , please advice
>
> 4. What is your SA glue layer?
>
> Both exim and spamassin services runs in the same server , exim calls
> spamassin via 127.0.0.1 address
>
> 5. What hardware is devoted to SA? Is it perhaps overloaded?
> Its runs on vmware server
>
> Thank You
>
>
>
> On 22 February 2014 03:55, Kevin A. McGrail <KM...@pccc.com> wrote:
>
>> What's your spamd parameters? something like ps auxwwww | grep spamd
>>
>>
>>
>
Re: Spamassassin Timeout error
Posted by John Hardin <jh...@impsec.org>.
On Sat, 22 Feb 2014, parakrama55 . wrote:
> Yes still getting timeouts
I was just surprised that exim wasn't willing to wait 20sec for the scan
to complete.
> using 4 CPUS
>
> Cpu0 : 73.5%us, 1.1%sy, 0.0%ni, 22.0%id, 1.6%wa, 0.1%hi, 1.8%si,
> 0.0%st
> Cpu1 : 70.6%us, 1.0%sy, 0.0%ni, 23.9%id, 1.2%wa, 0.0%hi, 3.3%si,
> 0.0%st
> Cpu2 : 70.4%us, 0.8%sy, 0.0%ni, 24.3%id, 1.1%wa, 0.0%hi, 3.4%si,
> 0.0%st
> Cpu3 : 69.9%us, 0.8%sy, 0.0%ni, 24.9%id, 1.0%wa, 0.0%hi, 3.4%si,
> 0.0%st
OK, it looks like you're fairly well-provisioned there.
What version of SA is this?
Do you have any local rules defined, or any third-party rules? Or just the
stock rules?
How recently were your stock rules updated?
Do you know how to run spamassassin against a single message in debug
mode?
> On 22 February 2014 04:09, John Hardin <jh...@impsec.org> wrote:
>
>> On Sat, 22 Feb 2014, parakrama55 . wrote:
>>
>> Spmd parameters
>>> ==============
>>>
>>> ps auxwwww | grep spamd
>>> root 6679 0.3 1.3 130064 66940 ? Ss 13:45 0:07
>>> /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s
>>> /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid
>>> 102 8747 82.5 1.4 136320 73632 ? R 14:22 2:23 spamd
>>> child
>>> nobody 8754 85.8 1.4 136228 73600 ? R 14:22 2:23 spamd
>>> child
>>> nobody 8772 87.6 1.4 135980 73388 ? R 14:22 2:07 spamd
>>> child
>>> 102 8814 84.2 1.4 136052 73368 ? D 14:23 1:41 spamd
>>> child
>>> root 8979 0.0 0.0 6032 720 pts/0 S+ 14:25 0:00 grep
>>> spamd
>>>
>>>
>> 2. Can you check your SA logs and see what the average scan times look
>>> like?
>>>
>>> Scan time varis beteen 1 - 20 seconds
>>>
>>
>> Yet exim times out?
>>
>>
>> 3 .Do you know how to change the timeout in the SA glue?
>>> No , please advice
>>>
>>
>> I'm not familiar with exim, sorry.
>>
>>
>> 4. What is your SA glue layer?
>>>
>>> Both exim and spamassin services runs in the same server , exim calls
>>> spamassin via 127.0.0.1 address
>>>
>>> 5. What hardware is devoted to SA? Is it perhaps overloaded?
>>> Its runs on vmware server
>>>
>>
>> I see 5GB RAM in the earlier mail, and no swap in use, so you appear OK
>> for RAM. How many CPUs does the VM have assigned?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Maxim VI: If violence wasn’t your last resort, you failed to resort
to enough of it.
-----------------------------------------------------------------------
Tomorrow: George Washington's 282nd Birthday
Re: Spamassassin Timeout error
Posted by "parakrama55 ." <pa...@gmail.com>.
Hi..
Yes still getting timeouts
using 4 CPUS
Cpu0 : 73.5%us, 1.1%sy, 0.0%ni, 22.0%id, 1.6%wa, 0.1%hi, 1.8%si,
0.0%st
Cpu1 : 70.6%us, 1.0%sy, 0.0%ni, 23.9%id, 1.2%wa, 0.0%hi, 3.3%si,
0.0%st
Cpu2 : 70.4%us, 0.8%sy, 0.0%ni, 24.3%id, 1.1%wa, 0.0%hi, 3.4%si,
0.0%st
Cpu3 : 69.9%us, 0.8%sy, 0.0%ni, 24.9%id, 1.0%wa, 0.0%hi, 3.4%si,
0.0%st
Thank You
On 22 February 2014 04:09, John Hardin <jh...@impsec.org> wrote:
> On Sat, 22 Feb 2014, parakrama55 . wrote:
>
> Spmd parameters
>> ==============
>>
>> ps auxwwww | grep spamd
>> root 6679 0.3 1.3 130064 66940 ? Ss 13:45 0:07
>> /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s
>> /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid
>> 102 8747 82.5 1.4 136320 73632 ? R 14:22 2:23 spamd
>> child
>> nobody 8754 85.8 1.4 136228 73600 ? R 14:22 2:23 spamd
>> child
>> nobody 8772 87.6 1.4 135980 73388 ? R 14:22 2:07 spamd
>> child
>> 102 8814 84.2 1.4 136052 73368 ? D 14:23 1:41 spamd
>> child
>> root 8979 0.0 0.0 6032 720 pts/0 S+ 14:25 0:00 grep
>> spamd
>>
>>
> 2. Can you check your SA logs and see what the average scan times look
>> like?
>>
>> Scan time varis beteen 1 - 20 seconds
>>
>
> Yet exim times out?
>
>
> 3 .Do you know how to change the timeout in the SA glue?
>> No , please advice
>>
>
> I'm not familiar with exim, sorry.
>
>
> 4. What is your SA glue layer?
>>
>> Both exim and spamassin services runs in the same server , exim calls
>> spamassin via 127.0.0.1 address
>>
>> 5. What hardware is devoted to SA? Is it perhaps overloaded?
>> Its runs on vmware server
>>
>
> I see 5GB RAM in the earlier mail, and no swap in use, so you appear OK
> for RAM. How many CPUs does the VM have assigned?
>
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> Maxim VI: If violence wasn't your last resort, you failed to resort
> to enough of it.
>
> -----------------------------------------------------------------------
> Tomorrow: George Washington's 282nd Birthday
>
Re: Spamassassin Timeout error
Posted by John Hardin <jh...@impsec.org>.
On Sat, 22 Feb 2014, parakrama55 . wrote:
> Spmd parameters
> ==============
>
> ps auxwwww | grep spamd
> root 6679 0.3 1.3 130064 66940 ? Ss 13:45 0:07
> /usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s
> /var/log/spamassass.log -d --pidfile=/var/run/spamd.pid
> 102 8747 82.5 1.4 136320 73632 ? R 14:22 2:23 spamd child
> nobody 8754 85.8 1.4 136228 73600 ? R 14:22 2:23 spamd child
> nobody 8772 87.6 1.4 135980 73388 ? R 14:22 2:07 spamd child
> 102 8814 84.2 1.4 136052 73368 ? D 14:23 1:41 spamd child
> root 8979 0.0 0.0 6032 720 pts/0 S+ 14:25 0:00 grep spamd
>
> 2. Can you check your SA logs and see what the average scan times look like?
>
> Scan time varis beteen 1 - 20 seconds
Yet exim times out?
> 3 .Do you know how to change the timeout in the SA glue?
> No , please advice
I'm not familiar with exim, sorry.
> 4. What is your SA glue layer?
>
> Both exim and spamassin services runs in the same server , exim calls
> spamassin via 127.0.0.1 address
>
> 5. What hardware is devoted to SA? Is it perhaps overloaded?
> Its runs on vmware server
I see 5GB RAM in the earlier mail, and no swap in use, so you appear OK
for RAM. How many CPUs does the VM have assigned?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Maxim VI: If violence wasn’t your last resort, you failed to resort
to enough of it.
-----------------------------------------------------------------------
Tomorrow: George Washington's 282nd Birthday
Re: Spamassassin Timeout error
Posted by John Horne <jo...@plymouth.ac.uk>.
On Fri, 2014-02-21 at 14:57 -0800, John Hardin wrote:
> On Sat, 22 Feb 2014, parakrama55 . wrote:
>
> > 3 .Do you know how to change the timeout in the SA glue?
> > No , please advice
> >
> > 4. What is your SA glue layer?
> >
> > Both exim and spamassin services runs in the same server , exim calls
> > spamassin via 127.0.0.1 address
>
> This may help:
> http://commons.oreilly.com/wiki/index.php/SpamAssassin/Integrating_SpamAssassin_with_Exim#Setting_a_timeout_on_spamc
>
I think that is a bit old; not sure if sa-Exim is still
supported/maintained. This link may be more useful:
http://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html
Typically we limit the resources SA uses by message size (done by Exim),
and set a timeout for SA (done by SA using 'time_limit' in our local.cf
file).
John.
--
John Horne Tel: +44 (0)1752 587287
Plymouth University, UK Fax: +44 (0)1752 587001
Re: Spamassassin Timeout error
Posted by John Hardin <jh...@impsec.org>.
On Sat, 22 Feb 2014, parakrama55 . wrote:
> 3 .Do you know how to change the timeout in the SA glue?
> No , please advice
>
> 4. What is your SA glue layer?
>
> Both exim and spamassin services runs in the same server , exim calls
> spamassin via 127.0.0.1 address
This may help:
http://commons.oreilly.com/wiki/index.php/SpamAssassin/Integrating_SpamAssassin_with_Exim#Setting_a_timeout_on_spamc
If this is how SA is integrated into your exim, see if you can determine
what the current spamc timeout is set to.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Maxim VI: If violence wasn’t your last resort, you failed to resort
to enough of it.
-----------------------------------------------------------------------
Tomorrow: George Washington's 282nd Birthday
Re: Spamassassin Timeout error
Posted by "parakrama55 ." <pa...@gmail.com>.
Hi guys
Spmd parameters
==============
ps auxwwww | grep spamd
root 6679 0.3 1.3 130064 66940 ? Ss 13:45 0:07
/usr/sbin/spamd --create-prefs --max-children 4 --helper-home-dir -s
/var/log/spamassass.log -d --pidfile=/var/run/spamd.pid
102 8747 82.5 1.4 136320 73632 ? R 14:22 2:23 spamd child
nobody 8754 85.8 1.4 136228 73600 ? R 14:22 2:23 spamd child
nobody 8772 87.6 1.4 135980 73388 ? R 14:22 2:07 spamd child
102 8814 84.2 1.4 136052 73368 ? D 14:23 1:41 spamd child
root 8979 0.0 0.0 6032 720 pts/0 S+ 14:25 0:00 grep spamd
1. If it is not happening on all messages, how large are the messages it is
happening on?
Yes now its happen for the all the messages
2. Can you check your SA logs and see what the average scan times look like?
Scan time varis beteen 1 - 20 seconds
3 .Do you know how to change the timeout in the SA glue?
No , please advice
4. What is your SA glue layer?
Both exim and spamassin services runs in the same server , exim calls
spamassin via 127.0.0.1 address
5. What hardware is devoted to SA? Is it perhaps overloaded?
Its runs on vmware server
Thank You
On 22 February 2014 03:55, Kevin A. McGrail <KM...@pccc.com> wrote:
> What's your spamd parameters? something like ps auxwwww | grep spamd
>
>
>
Re: Spamassassin Timeout error
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
What's your spamd parameters? something like ps auxwwww | grep spamd
Re: Spamassassin Timeout error
Posted by "parakrama55 ." <pa...@gmail.com>.
Hi guys
thanks for the updae
i have running simple spamaasain setup for 1 year now , it working fine up
to yesterday , After that spamassain server stated to run in higher load
and cpu usage even during the time ware no mails mail que.
We have exim server and spamassain server runs in the same machine (
Operating system Debian 6)
Here is output of the top command
===========================
Tasks: 179 total, 5 running, 174 sleeping, 0 stopped, 0 zombie
Cpu(s): 91.8%us, 0.4%sy, 0.0%ni, 7.1%id, 0.0%wa, 0.0%hi, 0.6%si,
0.0%st
Mem: 5097380k total, 555760k used, 4541620k free, 63740k buffers
Swap: 477176k total, 0k used, 477176k free, 104396k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+
COMMAND
6701 nobody 20 0 136m 74m 2824 R 83 1.5 14:12.38
spamd
6700 nobody 20 0 135m 74m 2836 R 98 1.5 14:03.64
spamd
6705 Debian-e 20 0 135m 74m 2824 R 88 1.5 14:10.12
spamd
6706 Debian-e 20 0 134m 73m 2824 R 99 1.5 14:20.74
spamd
6679 root 20 0 127m 65m 2284 S 0 1.3 0:05.62
spamd
1318 root 20 0 40872 8736 1364 S 0 0.2 0:02.71
python
1284 snmp 20 0 47568 5152 2800 S 0 0.1 0:01.89
snmpd
1277 root 20 0 78704 3812 2924 S 0 0.1 0:08.14 vmtoolsd
in our spamassin log we are continuously getting timeout error ?
2014-02-21 14:14:53 1WGyJ0-00027w-3p SMTP connection lost after final dot H=
p5798a690.dip0.t-ipconnect.de [87.152.166.144] P=esmtp
2014-02-21 14:14:53 1WGyMp-0002AY-Ft spam acl condition: warning - spamd
connection to 127.0.0.1, port 783 failed: Connection timed out
2014-02-21 14:14:53 1WGyMp-0002AY-Ft spam acl condition: all spamd servers
failed
2014-02-21 14:14:53 1WGyMp-0002AY-Ft H=(client-200.121.7.219.speedy.net.pe)
[200.121.7.219] Warning: ACL "warn" statement skipped: condition test
deferred
2014-02-21 14:14:53 no IP address found for host
host-186-101-186-114.uio.netlife.ec (during SMTP connection from
[186.101.186.114])
2014-02-21 14:14:54 1WGyKz-00029K-Gz spam acl condition: error reading from
spamd socket: Connection timed out
2014-02-21 14:14:54 1WGyKz-00029K-Gz H=
dslb-088-070-068-158.pools.arcor-ip.net [88.70.68.158] Warning: ACL "warn"
statement skipped: condition test deferred
2014-02-21 14:14:54 1WGyKz-00029N-JG spam acl condition: error reading from
spamd socket: Connection timed out
2014-02-21 14:14:54 1WGyKz-00029N-JG H=([177.53.108.184]) [177.53.108.184]
Warning: ACL "warn" statement skipped: condition test deferred
2014-02-21 14:14:54 1WGyKv-00029G-3w spam acl condition: error reading from
spamd socket: Connection timed out
2014-02-21 14:14:54 1WGyKv-00029G-3w SA: Debug: SAEximRunCond expand
returned: '0'
2014-02-21 14:14:54 1WGyKv-00029G-3w SA: Action: Not running SA because
SAEximRunCond expanded to false (Message-Id: 1WGyKv-00029G-3w). From <
e1jnrtv-00028o-ic@cdsdoors.com> (host=NULL [179.180.28.209]
Im not sure where to look at and how fix the issue , please advice
Thanks
On 21 February 2014 22:22, John Hardin <jh...@impsec.org> wrote:
> On Fri, 21 Feb 2014, parakrama55 . wrote:
>
> we are getting follwing errors in the logs,
>>
>> 2014-02-21 05:50:27 1WGqSi-0003d7-Pi spam acl condition: error reading
>> from
>> spamd socket: Connection timed out
>> 2014-02-21 05:50:27 1WGqSi-0003dD-9p spam acl condition: error reading
>> from
>> spamd socket: Connection timed out
>>
>> Seems like because of this mail server ignore spamassain check
>>
>> Is there any reason for that , Please advice how to fix this issue
>>
>
> We need some more information before we can provide any meaningful advice.
>
> The most important questions are:
>
> What is your SA glue layer? (How is SA hooked into your MTA? There are
> several ways this can be done.)
>
> Do you know what the timeout in the SA glue is currently set to?
>
> Do you know how to change the timeout in the SA glue?
>
> Other questions needed to offer advice more specific than just "increase
> the timeout" are:
>
> How frequently is this happening?
>
> If it is not happening on all messages, how large are the messages it is
> happening on?
>
> Can you check your SA logs and see what the average scan times look like?
>
> What hardware is devoted to SA? Is it perhaps overloaded?
>
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> The Tea Party wants to remove the Crony from Crony Capitalism.
> OWS wants to remove Capitalism from Crony Capitalism.
> -- Astaghfirullah
> -----------------------------------------------------------------------
> Tomorrow: George Washington's 282nd Birthday
>
Re: Spamassassin Timeout error
Posted by John Hardin <jh...@impsec.org>.
On Fri, 21 Feb 2014, parakrama55 . wrote:
> we are getting follwing errors in the logs,
>
> 2014-02-21 05:50:27 1WGqSi-0003d7-Pi spam acl condition: error reading from
> spamd socket: Connection timed out
> 2014-02-21 05:50:27 1WGqSi-0003dD-9p spam acl condition: error reading from
> spamd socket: Connection timed out
>
> Seems like because of this mail server ignore spamassain check
>
> Is there any reason for that , Please advice how to fix this issue
We need some more information before we can provide any meaningful advice.
The most important questions are:
What is your SA glue layer? (How is SA hooked into your MTA? There are
several ways this can be done.)
Do you know what the timeout in the SA glue is currently set to?
Do you know how to change the timeout in the SA glue?
Other questions needed to offer advice more specific than just "increase
the timeout" are:
How frequently is this happening?
If it is not happening on all messages, how large are the messages it is
happening on?
Can you check your SA logs and see what the average scan times look like?
What hardware is devoted to SA? Is it perhaps overloaded?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The Tea Party wants to remove the Crony from Crony Capitalism.
OWS wants to remove Capitalism from Crony Capitalism.
-- Astaghfirullah
-----------------------------------------------------------------------
Tomorrow: George Washington's 282nd Birthday
Re: Spamassassin Timeout error
Posted by John Horne <jo...@plymouth.ac.uk>.
On Fri, 2014-02-21 at 19:24 +0530, parakrama55 . wrote:
> we are getting follwing errors in the logs,
>
> 2014-02-21 05:50:27 1WGqSi-0003d7-Pi spam acl condition: error reading
> from spamd socket: Connection timed out
> 2014-02-21 05:50:27 1WGqSi-0003dD-9p spam acl condition: error reading
> from spamd socket: Connection timed out
>
Hello,
We get quite a few of these on a couple of our old mail servers. They
are overloaded systems, and so it takes too long to run SA. Exim cuts in
in order for the message to actually be accepted within an overall 5
minute time limit. You might want to check the SA and exim logs to see
what is going on, and run 'top' to see how busy the servers get.
John.
--
John Horne Tel: +44 (0)1752 587287
Plymouth University, UK Fax: +44 (0)1752 587001