error reading from spamd socket: Connection timed out Options

[dev_cw]

First of all I wish to thank RvSkins for the great SPAM protection instructions. I have this installed on my server and it has lowered the SPAM flow greatly.

I have been running the SPAM setup for one week now and I notice that I have been getting the following error in the paniclog about 3 or 4 times a day:

CODE

spam acl condition: error reading from spamd socket: Connection timed out

In checking the logs I can see that the email in question was actually processed 30seconds after the error message, so the message is either going through or being blocked acordingly. For Example:

CODE

2006-11-03 21:31:03 1Gg8T8-0008Or-4L spam acl condition: error reading from spamd socket: Connection timed out
2006-11-03 21:31:34 1Gg8T8-0008Or-4L <= crawford@hystersisters.com H=(dsl-189-140-74-185.prod-infinitum.com.mx) [189.140.74.185] P=esmtp S=3831 id=01c6ff9f$e0845650$6c822ecf@crawford T="A Rolex replica watch"
2006-11-03 21:31:34 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Gg8T8-0008Or-4L
2006-11-03 21:31:35 1Gg8T8-0008Or-4L ** F=crawford@hystersisters.com [189.140.74.185] discarded: Spam score too high (53.5)
2006-11-03 21:31:35 1Gg8T8-0008Or-4L => discarded (system filter)
2006-11-03 21:31:35 1Gg8T8-0008Or-4L Completed

What can I do to stop these errors?

About our server: We have two photo production firms hosted with us and they regularly send/receive large (15 - 20MB) emails.

[pairote]

It is very strange. If the spamd is timed out, it should not get the spam score and email should save in the user inbox as usual instead filtered out. I would suggest increase the spamd children maximum process, please go to WHM / cPanel xx.x.x-xxx / Addon Modules, and install spamdconf. Close your WHM, and reopen it again. You will find the menu 'Setup Spamd Startup Configuration' at the bottom of the left menu. Change the Maximum Children to 10 or 15.

If your server usually relay a large email, you may need to adjust the maximum file size for SA to process or even whitelist those domain for spam scanning to reduce unnecessary CPU usage.

[dev_cw]

Raised the Maximum Children but it raised the server load too much so I had to lowered it again.

I still will get the occasional error but I can tell it is related to the server load which has been spiking every once in a while ever since I applied the Anti-Spam setup.

What I did notice is that every entry in my maillog appears doubled. Is this normal? I never looked at this log too much in the past to notice this before. Anyway, I may try some of the extra steps mentioned in this forum to see if it helps the server load.

BTW - I am on a 512MB VPS server.

Here are my spam stats:

CODE

Exim statistics from 2006-11-10 00:00:32 to 2006-11-10 23:53:28

Grand total summary
-------------------
                                                        At least one address
  TOTAL               Volume    Messages     Hosts      Delayed       Failed
  Received             182MB         949       346       7  0.7%     76  8.0%
  Delivered            255MB        1514       112

User Specified Patterns
-----------------------
                       Total
  Total mail blocked:............................................................................
.....    1754
  Verify sender at SMTP time:..........................................................................     943
  Spam mail blocked by manual blacklist sender at the SMTP time:.......................................       0
  Spam mail blocked by manual blacklist host address at the SMTP time:.................................       0
  Spam mail blocked by auto black list SA high score at the SMTP time:.................................       0
  Spam mail blocked by invalid HELO at the SMTP time:..................................................      32
  Spam mail blocked by setting default address to :fail: at the SMTP time:.............................     132
  Spam mail blocked by auto black list after dictionary attack the SMTP time:..........................      20
  Spam mail blocked by RBL at the SMTP time:...........................................................     158
  Spam mail blocked by illegal File extension at the SMTP time and discarded after recieving email:....       0
  Spam mail blocked by virus scanner at the SMTP time or discarded after recieving email:..............       0
  Spam mail blocked by SA at the SMTP time or discarded after recieving email:.........................     470
  Spam mail discared by SA high score (12-15) after recieving email:...................................      67

Thanks for the help.

[pairote]

Your server is quiet touch. VPS server is not suitable to handle the SA scanning if there is high email connection. If you want to reduce the resource consumption, I suggest you add bl.spamcop.net on the RBL ACL. But on the expense of more false positive.