Jack Gostl wrote:
You are forgetting that there are two pieces here, spamc and spamd. spamc has a timeout. I believe it works like this.
spamc sends the message to spamd. If spamd doesn't finish in time, spamc goes ahead and releases the message unchanged. This doesn't shut down spamd, which continues to process, and log its actions, but when it tries to respond to spamc, the other end of the socket is gone.
True. Spamd is easiest to follow through debugging messages, though. In looking at the logs for spamd (see the original email), I don't see any particular delays. The entire message appears to be processed in around 2 seconds, including the RBLs.
So, unless something's breaking in between spamd and spamc, it appears that the message is getting returned in around 2 seconds, based on the spamd logs. I don't see spamd processes hanging around longer than that, so I'm pretty doubtful that anythings handing.
On my production machine, if I get a surge of email, or after restarting SA, I sometimes see processing times go into the tens of seconds. If so, spamc still waits paitently.
I'm going to watch the spamd/spamc communication with ngrep for a while... that should confirm what traffic is being passed.
Watch out for surges that cause it to hit MAX_CHILD, or some other throttle. Might even be a sendmail throttle. Doesn't matter if spamd needs only 2 seconds if there are 15 guys ahead of it in line and MAX_CHILD is set to 10.
Nothing like that on my test box... Could be an issue on the production box (max children of 10, 20K emails/day), but I've only seen things queue up. If sendmail was throttling, it would result in requeuing, not bypassing SA. Once sendmail hands off the email to the LDA, it can't suddenly decide to drop it in my mailbox and ignore what procmail is doing to it. Plus, I've got an external MX in queue-only (mostly because I'm running amavis on the external MX) so the main mail server sees a fairly steady flow of mail.
On the test box I've got max_children=6. since it's only running my account, I never see it get anywhere near that ammount of children running.
When the production machine gets swamped, I do see a boatload of sendmail and procmail processes on the mail server, load can climb >10, and I can have around 300 processes running. spam still gets tagged, eventually, though. None of that is happening here (on the test machine), though.
--Rich
_________________________________________________________
Rich Puhek ETN Systems Inc. 2125 1st Ave East Hibbing MN 55746
tel: 218.262.1130 email: [EMAIL PROTECTED] _________________________________________________________
------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
