Yes! ... i now officially feel like a moron :-) ... yr right ... zabbix makes a tcp connection to port 783 to check it's running ... switching monitoring on and off ... switches the error on and off ... I'll look for the spamd process instead as a monitoring means ... I guees the fact the event correlated with a flood of spam getting through - made me chase for bigger issues' ... but hey ..
thank you kindly for the help :-) .. Justin Mason wrote: > > > I think you misunderstand. the error message is entirely normal and not > indicative of a bug. it's produced when something (such as monitoring > software!) opens a TCP connection to the spamd port, then closes it again. > > --j. > > gable writes: >> we have monitoring in place .. zabbix in this case .. The process isn't >> dying, tailing the logs .. and checking processes .. the spamd process is >> up >> and running ... but the connection between spamc and the daemon isn't >> talking correctly .... A fellow sysadmi seems to think it's something to >> do >> with IO::Handle perl module ...they had the exact same errors .... and >> blamed it on that! >> >> >> Justin Mason wrote: >> > >> > >> > that's the error message produced when the connection is closed >> > before any data is sent. Have you got an nmap running every 5 >> > minutes? or some kind of keep-alive daemon checking to see if >> > spamd is running? >> > >> > --j. >> > >> > gable writes: >> >> gable wrote: >> >> > >> >> > Hiya >> >> > >> >> > Has anyone come across error like these before - spamassassin was >> >> working >> >> > perfect - but a couple of days ago - we got flooded with spam. >> Checking >> >> > the logs ... errors like the one below come up 25,000 times :-) ... >> The >> >> > only solution i've found to work is to keep restarting spamd on a >> crond >> >> > ... a temporary fix .. >> >> > >> >> > Sun Mar 11 15:46:15 2007 [26282] info: spamd: connection from >> >> > mxr1duk.xxxxx.com [127.0.0.1] at port 36877 >> >> > Sun Mar 11 15:46:15 2007 [26282] warn: spamd: bad protocol: header >> >> error: >> >> > (closed before headers) at /usr/bin/spamd line 1671. >> >> > Sun Mar 11 15:46:15 2007 [26280] info: prefork: child states: II >> >> > Sun Mar 11 15:46:20 2007 [26282] info: spamd: connection from >> >> > mxr1duk.xxxxx.com [127.0.0.1] at port 36878 >> >> > Sun Mar 11 15:46:20 2007 [26282] warn: spamd: bad protocol: header >> >> error: >> >> > (closed before headers) at /usr/bin/spamd line 1671. >> >> > Sun Mar 11 15:46:20 2007 [26280] info: prefork: child states: II >> >> > Sun Mar 11 15:46:25 2007 [26282] info: spamd: connection from >> >> > mxr1duk.xxxxx.com [127.0.0.1] at port 36879 >> >> > Sun Mar 11 15:46:25 2007 [26282] warn: spamd: bad protocol: header >> >> error: >> >> > (closed before headers) at /usr/bin/spamd line 1671. >> >> > Sun Mar 11 15:46:25 2007 [26280] info: prefork: child states: II >> >> > Sun Mar 11 15:46:31 2007 [26282] info: spamd: connection from >> >> > mxr1duk.xxxxx.com [127.0.0.1] at port 36880 >> >> > Sun Mar 11 15:46:31 2007 [26282] warn: spamd: bad protocol: header >> >> error: >> >> > (closed before headers) at /usr/bin/spamd line 1671. >> >> > Sun Mar 11 15:46:31 2007 [26280] info: prefork: child states: II >> >> > >> >> > >> >> > any assistance would be much appreciated >> >> > >> >> > Cheers ... >> >> > >> >> > >> >> >> >> A little more information .. apologizes ... I'm running postfix .. >> >> spamassassin 3.1.8-2.fc6 ... the spamd daemon is called from postfix >> via >> >> the >> >> follow script >> >> >> >> #!/bin/sh >> >> SENDMAIL="/usr/lib/sendmail.postfix -i" >> >> SPAMASSASSIN=/usr/bin/spamc >> >> >> >> # Exit codes from <sysexits.h> >> >> EX_TEMPFAIL=75 >> >> EX_UNAVAILABLE=69 >> >> >> >> umask 077 >> >> >> >> OUTPUT="`mktemp /tmp/mailfilter.XXXXXXXXXX`" >> >> if [ "$?" != 0 ]; then >> >> /usr/bin/logger -s -p mail.warning -t filter \ >> >> "Unable to create temporary file." >> >> exit $EX_TEMPFAIL >> >> fi >> >> >> >> # Clean up when done or when aborting. >> >> trap "rm -f $OUTPUT" EXIT SIGTERM >> >> >> >> $SPAMASSASSIN -x > $OUTPUT >> >> return="$?" >> >> if [ "$return" == 1 ]; then >> >> echo "Message content rejected" >> >> exit $EX_UNAVAILABLE >> >> elif [ "$return" != 0 ]; then >> >> /usr/bin/logger -s -p mail.warning -t filter \ >> >> "Temporary SpamAssassin failure (spamc return $return)" >> >> exit $EX_TEMPFAIL >> >> fi >> >> >> >> $SENDMAIL "$@" < $OUTPUT >> >> exit $? >> >> >> >> I'm pretty sure its something i've done wrong ... the same error >> started >> >> on >> >> both relays ... a minute apart from one another - no manual/automatic >> >> installl's happened (yum.log) ... and the configs and exactly as they >> >> were >> >> before ... nothing has really be changed .. *rolling eyes* :) .. >> >> >> >> >> >> >> >> >> >> -- >> >> View this message in context: >> >> >> http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9425778 >> >> Sent from the SpamAssassin - Users mailing list archive at Nabble.com. >> > >> > >> >> -- >> View this message in context: >> http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9426266 >> Sent from the SpamAssassin - Users mailing list archive at Nabble.com. > > -- View this message in context: http://www.nabble.com/protocol-error-in-spamassassin-tf3386186.html#a9431646 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
