spamd: logger: try using --syslog-socket={unix,inet} or --syslog=file

[Nikolaus Rath <Ni...@rath.org>]

Hello,

For a couple of weeks now, spamd has been occasionally logging messages
like this:

Aug  4 02:49:58 ebox spamd[5555]: logger: try using --syslog-socket={unix,inet} or --syslog=file
Aug  4 02:49:59 ebox spamd[30417]: logger: try using --syslog-socket={unix,inet} or --syslog=file

Generally this doesn't seem to happen more than once a day and seems to
coincide with some spamd childs taking exceptionally long to process a
message:

Aug  4 02:48:44 ebox spamd[30417]: spamd: clean message (-6.6/5.0) for nobody:107 in 181.4 seconds, 2195 bytes.

Compared to

Aug  4 03:52:12 ebox spamd[5555]: spamd: clean message (-19.2/5.0) for nobody:107 in 1.4 seconds, 4242 bytes. 

Also, the messages do *not* show up when spamd starts or reloads (at
least not in the next 5 minutes).

Can anyone tell me what this means?


Best,

   -Nikolaus

-- 
 »Time flies like an arrow, fruit flies like a Banana.«

  PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6  02CF A9AD B7F8 AE4E 425C

Re: spamd: logger: try using --syslog-socket={unix,inet} or --syslog=file

[Nikolaus Rath <Ni...@rath.org>]

Karsten Bräckelmann <gu...@rudersport.de> writes:
> On Wed, 2010-08-04 at 14:14 -0400, Nikolaus Rath wrote:
>> For a couple of weeks now, spamd has been occasionally logging messages
>> like this:
>> 
>> Aug  4 02:49:58 ebox spamd[5555]: logger: try using --syslog-socket={unix,inet} or --syslog=file
>> Aug  4 02:49:59 ebox spamd[30417]: logger: try using --syslog-socket={unix,inet} or --syslog=file
>> 
>> Generally this doesn't seem to happen more than once a day and seems to
>> coincide with some spamd childs taking exceptionally long to process a
>> message:
>
> After a quick grep and briefly looking at the code in Logger::Syslog, my
> guess is that logging failed for some reason. That probably also
> explains the long processing time. You also should see warnings logged
> like this
>   logger: syslog failed: $eval_stat

No, there are no such messages. But the whole think seems a bit
paradoxical anyway, since if the logging failed the message should not
appear in the system log, should it?

> where the $eval_stat hopefully will give some more hints. What are you
> using for logging in SA?

I am starting spamd with --syslog-socket=unix, is that what you mean?


Best,

   -Nikolaus

-- 
 »Time flies like an arrow, fruit flies like a Banana.«

  PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6  02CF A9AD B7F8 AE4E 425C

Re: spamd: logger: try using --syslog-socket={unix,inet} or --syslog=file

[Karsten Bräckelmann <gu...@rudersport.de>]

On Wed, 2010-08-04 at 14:14 -0400, Nikolaus Rath wrote:
> For a couple of weeks now, spamd has been occasionally logging messages
> like this:
> 
> Aug  4 02:49:58 ebox spamd[5555]: logger: try using --syslog-socket={unix,inet} or --syslog=file
> Aug  4 02:49:59 ebox spamd[30417]: logger: try using --syslog-socket={unix,inet} or --syslog=file
> 
> Generally this doesn't seem to happen more than once a day and seems to
> coincide with some spamd childs taking exceptionally long to process a
> message:

After a quick grep and briefly looking at the code in Logger::Syslog, my
guess is that logging failed for some reason. That probably also
explains the long processing time. You also should see warnings logged
like this
  logger: syslog failed: $eval_stat

where the $eval_stat hopefully will give some more hints. What are you
using for logging in SA?

  guenther


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}