Folks, I, too, have been having somewhat similar issues with 3.1.7. On a RH ES 3.0u7 box, kernel 2.4.21-40.ELsmp, I see these symptoms in syslog (spamd running with "-s local2"):
Oct 14 21:42:01 samler1 spamd[18694]: prefork: child states: III Oct 14 21:42:01 samler1 spamd[14338]: spamd: connection from localhost.localdomain [127.0.0.1] at port 60505 Oct 14 21:42:01 samler1 spamd[14338]: spamd: processing message <[EMAIL PROTECTED]> for mailadm:500 Oct 14 21:42:01 samler1 spamd[14338]: spamd: clean message (0.0/5.0) for mailadm:500 in 0.046 seconds, 2059 bytes. Oct 14 21:42:01 samler1 spamd[14338]: spamd: result: . 0 - HTML_MESSAGE scantime=0.046,size=2059,user=mailadm,uid=500,required_score=5.0,rhost=l ocalhost.localdomain,raddr=127.0.0.1,rport=60505,mid=<000001c6f014$365c5 [EMAIL PROTECTED]>,autolearn=disabled Oct 14 21:47:02 samler1 spamd[18328]: prefork: sysread(8) failed after 300 secs at /usr/local/spam/lib/perl5/site_perl/5.6.2/Mail/SpamAssassin/SpamdForkSca ling.pm line 561. Oct 14 21:47:02 samler1 spamd[14338]: prefork: sysread(7) failed after 300 secs at /usr/local/spam/lib/perl5/site_perl/5.6.2/Mail/SpamAssassin/SpamdForkSca ling.pm line 561. spamd's 2 kids are both marked defunct in a 'ps', and spamd processing is effectively *stopped*. This isn't a good thing -- a 'kill -9' and spamd restart is necessary to get things running again. What do I start to look at? rnd -----Original Message----- From: Chris Lear [mailto:[EMAIL PROTECTED] Sent: Monday, October 16, 2006 5:32 AM To: SpamAssassin Subject: Spamd not killing children Subject sounds unpleasantly like incitement to filicide, for which I apologise. The problem I'm having is that spamd doesn't seem to be able to clean up unwanted idle child processes. Here's the logfile evidence: Oct 16 00:12:59 marvin spamd[6351]: prefork: child states: III Oct 16 00:13:09 marvin spamd[18043]: spamd: connection from localhost [127.0.0.1] at port 35720 Oct 16 00:13:09 marvin spamd[18043]: spamd: setuid to spamd succeeded Oct 16 00:13:09 marvin spamd[18043]: spamd: checking message <[EMAIL PROTECTED]> for spamd:210 Oct 16 00:13:12 marvin spamd[25627]: spamd: connection from localhost [127.0.0.1] at port 35722 Oct 16 00:13:12 marvin spamd[25627]: spamd: setuid to spamd succeeded Oct 16 00:13:12 marvin spamd[25627]: spamd: checking message <[EMAIL PROTECTED]> for spamd:210 Oct 16 00:13:14 marvin spamd[18043]: spamd: identified spam (29.7/5.0) for spamd:210 in 5.3 seconds, 1545 bytes. Oct 16 00:13:14 marvin spamd[18043]: spamd: result: Y 29 - BAYES_99,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CF_RANG E_E8_51_100,RAZOR2_CHECK,URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,URIBL _OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL scantime=5.3,size=1545,user=spamd,uid=210,required_score=5.0,rhost=local host,raddr=127.0.0.1,rport=35720,mid=<[EMAIL PROTECTED]>,ba yes=0.999999999999891,autolearn=spam Oct 16 00:13:15 marvin spamd[6351]: prefork: child states: IBK -------------------------------------------------------------^ [...] Time passes, and spamd continues to work [...] Oct 16 10:18:00 marvin spamd[6351]: prefork: child states: IIKK -------------------------------------------------------------^^ spamd seems to be trying to kill child processes to get the number of threads down to 2. But for some (apparently unreported) reason the threads don't die, and the server is slowly collecting children marked as "K". I recently upgraded spamassassin to 3.1.5, and I also installed FuzzyOcr, which I suspect might be part of the problem. Can anyone tell me a) what logs to look in to work out why this has happened? (I've looked in the FuzzyOcr log, which does show some errors and timeouts, but apparently none at relevant times), b) whether there's anything I can do about it (I'll start by disabling FuzzyOcr, but I'd like to use it), or c) whether there's a spamassassin bug? I looked at the code in SpamdForkScaling.pm, and I see that there are 2 places where child processes are killed. In one place (sub child_error_kill, line 134), there is a warn line if the kill fails. In the other (sub need_to_del_server, line 732) there isn't. Chris
