Hi guys thanks for the updae
i have running simple spamaasain setup for 1 year now , it working fine up to yesterday , After that spamassain server stated to run in higher load and cpu usage even during the time ware no mails mail que. We have exim server and spamassain server runs in the same machine ( Operating system Debian 6) Here is output of the top command =========================== Tasks: 179 total, 5 running, 174 sleeping, 0 stopped, 0 zombie Cpu(s): 91.8%us, 0.4%sy, 0.0%ni, 7.1%id, 0.0%wa, 0.0%hi, 0.6%si, 0.0%st Mem: 5097380k total, 555760k used, 4541620k free, 63740k buffers Swap: 477176k total, 0k used, 477176k free, 104396k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 6701 nobody 20 0 136m 74m 2824 R 83 1.5 14:12.38 spamd 6700 nobody 20 0 135m 74m 2836 R 98 1.5 14:03.64 spamd 6705 Debian-e 20 0 135m 74m 2824 R 88 1.5 14:10.12 spamd 6706 Debian-e 20 0 134m 73m 2824 R 99 1.5 14:20.74 spamd 6679 root 20 0 127m 65m 2284 S 0 1.3 0:05.62 spamd 1318 root 20 0 40872 8736 1364 S 0 0.2 0:02.71 python 1284 snmp 20 0 47568 5152 2800 S 0 0.1 0:01.89 snmpd 1277 root 20 0 78704 3812 2924 S 0 0.1 0:08.14 vmtoolsd in our spamassin log we are continuously getting timeout error ? 2014-02-21 14:14:53 1WGyJ0-00027w-3p SMTP connection lost after final dot H= p5798a690.dip0.t-ipconnect.de [87.152.166.144] P=esmtp 2014-02-21 14:14:53 1WGyMp-0002AY-Ft spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection timed out 2014-02-21 14:14:53 1WGyMp-0002AY-Ft spam acl condition: all spamd servers failed 2014-02-21 14:14:53 1WGyMp-0002AY-Ft H=(client-200.121.7.219.speedy.net.pe) [200.121.7.219] Warning: ACL "warn" statement skipped: condition test deferred 2014-02-21 14:14:53 no IP address found for host host-186-101-186-114.uio.netlife.ec (during SMTP connection from [186.101.186.114]) 2014-02-21 14:14:54 1WGyKz-00029K-Gz spam acl condition: error reading from spamd socket: Connection timed out 2014-02-21 14:14:54 1WGyKz-00029K-Gz H= dslb-088-070-068-158.pools.arcor-ip.net [88.70.68.158] Warning: ACL "warn" statement skipped: condition test deferred 2014-02-21 14:14:54 1WGyKz-00029N-JG spam acl condition: error reading from spamd socket: Connection timed out 2014-02-21 14:14:54 1WGyKz-00029N-JG H=([177.53.108.184]) [177.53.108.184] Warning: ACL "warn" statement skipped: condition test deferred 2014-02-21 14:14:54 1WGyKv-00029G-3w spam acl condition: error reading from spamd socket: Connection timed out 2014-02-21 14:14:54 1WGyKv-00029G-3w SA: Debug: SAEximRunCond expand returned: '0' 2014-02-21 14:14:54 1WGyKv-00029G-3w SA: Action: Not running SA because SAEximRunCond expanded to false (Message-Id: 1WGyKv-00029G-3w). From < e1jnrtv-00028o...@cdsdoors.com> (host=NULL [179.180.28.209] Im not sure where to look at and how fix the issue , please advice Thanks On 21 February 2014 22:22, John Hardin <jhar...@impsec.org> wrote: > On Fri, 21 Feb 2014, parakrama55 . wrote: > > we are getting follwing errors in the logs, >> >> 2014-02-21 05:50:27 1WGqSi-0003d7-Pi spam acl condition: error reading >> from >> spamd socket: Connection timed out >> 2014-02-21 05:50:27 1WGqSi-0003dD-9p spam acl condition: error reading >> from >> spamd socket: Connection timed out >> >> Seems like because of this mail server ignore spamassain check >> >> Is there any reason for that , Please advice how to fix this issue >> > > We need some more information before we can provide any meaningful advice. > > The most important questions are: > > What is your SA glue layer? (How is SA hooked into your MTA? There are > several ways this can be done.) > > Do you know what the timeout in the SA glue is currently set to? > > Do you know how to change the timeout in the SA glue? > > Other questions needed to offer advice more specific than just "increase > the timeout" are: > > How frequently is this happening? > > If it is not happening on all messages, how large are the messages it is > happening on? > > Can you check your SA logs and see what the average scan times look like? > > What hardware is devoted to SA? Is it perhaps overloaded? > > > -- > John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > ----------------------------------------------------------------------- > The Tea Party wants to remove the Crony from Crony Capitalism. > OWS wants to remove Capitalism from Crony Capitalism. > -- Astaghfirullah > ----------------------------------------------------------------------- > Tomorrow: George Washington's 282nd Birthday >
