spamd failed, Crashing a LOT spamd Options

[obazavil]

Hi!

So far I have got excelent results:

CODE

===================
RBL Count = 272

spamhaus.org = 143
dsbl.org = 129
ordb.org = 0
===================
Manual = 0
verify fail = 76
No Relay = 13
No Such User = 98
===================
score too high = 63
Forged HELO = 218
virus = 33
invalid attachment = 51
===================
All Spam:
/var/log/exim_mainlog:822
/var/log/exim_mainlog.1.gz:1080
/var/log/exim_mainlog.2.gz:1231
/var/log/exim_mainlog.3.gz:68
/var/log/exim_mainlog.4.gz:218
===================

But, I'm geting a LOT of crashes on spamd:

CODE

spamd failed @ Tue Jan  4 09:56:44 2005. A restart was attempted automagicly.

I checked exim_paniclog, and I see a lot of this things:

CODE

2005-01-04 11:05:41 1Cls7n-0007yy-E5 spam acl condition: cannot parse spamd output
2005-01-04 11:05:41 1Cls7n-0007yy-E5 spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused
2005-01-04 11:05:41 1Cls7n-0007yy-E5 spam acl condition: all spamd servers failed
2005-01-04 11:05:41 1Cls7n-0007yy-E5 spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused
2005-01-04 11:05:41 1Cls7n-0007yy-E5 spam acl condition: all spamd servers failed

Someone has any idea of why this continous crashes?

[pairote]

I still not sure what cause the problem. It seems that something related to cPanel or Exiscan. If you find the error, restart EXIM should resolve the problem. I found this error one time.

[obazavil]

I reboted server, restarted exim, and problem still happens.

I switched back to "normal" exim.conf, and all works perfectly, no crashes of spamd.

I was told my server runs out of resources, and start crashing spamd.

I'll try a less restrictive config, and then see if crashing dissapears.

But well, now that i tasted spam filtering, can't come back

ja ne!

[pairote]

If you still want to use spamd at MTA, you should consider
1. Bring down the messages size that going to scan. Change it to 120K or 150K.
2. Add the sender that usually send email in and out of your server in rv_spam_sender_address_whitelist to reduce spamd load.


# Messages larger than 200k are accepted without spam scanning to reduce spamd load
accept condition = ${if >{$message_size}{200k}{true}}

##
# Reject spam messages with score over 15.
# Keep in mind that $spam_score_int is the messages score multiplied by ten.
##
deny message = Spam score too high ($spam_score)
# Bypass Sender that usually send a lot of emails to reduce spamd load
!senders = +rv_spam_sender_address_whitelist
spam = mailnull:true/defer_ok
condition = ${if >{$spam_score_int}{150}{1}{0}}

[obazavil]

ok.. i just changed it... i'll check how it performs

thanks for the help

something that i noticed is, i didn't chmod 755 of all whitelists (according to tutorial, because i have rvskin). But if i changed settings, they weren't saved. I fixed that chmoding 755 all whitelists.

But according to tutorial, should be necesary

just to let you know

thanks for this lovely guide.. i only have received 1 spam mail

ja ne!

[Guest_Exovian_*]

===================
score too high = 63
Forged HELO = 218
virus = 33
invalid attachment = 51
===================

How are you generating that report?

[robish]

can't solve my problems :s

[pairote]

i have the same problem.. hope someone can help us!

Please be more specific.

[takeover]

i'm having the same problems, like once every few weeks and i have to reboot the server

2006-04-18 21:21:29 1FW1N3-0001lR-2x spam acl condition: warning - spamd connection to 127.0.0.1, port 783 fail$
2006-04-18 21:21:29 1FW1N3-0001lR-2x spam acl condition: all spamd servers failed
2006-04-18 21:21:29 1FW1N3-0001lR-2x spam acl condition: warning - spamd connection to 127.0.0.1, port 783 fail$
2006-04-18 21:21:29 1FW1N3-0001lR-2x spam acl condition: all spamd servers failed

over and over, rebooting exim usually generates a fail for stoping and then starts it but if i do it again 30 seconds later exim is failed agian, only solution i've found is rebooting, but any help in actually solving the problem would be amazing.

[takeover]

problem seems to be temporarily fixed, may have had to do with large autowhitelists and bayes seen files, i had about a dozen over 5mb

[pairote]

I don't think the bayes files causing the issue.
On my servers, I also find the same issue but it occurs only when the server is overloaded. Not all the time, and spamd will automatically restarted when the load is cooled down.

There are 3 new ACLs that not updated in the tutorial yet. You may try it. It consume less CPU.
1. Disable Spam scanning for outgoing email. http://forums.rvskin.com/index.php?s=&show...findpost&p=4901
2. Rearrange the ACL for RBL and unknown user http://forums.rvskin.com/index.php?s=&show...findpost&p=4788
3. Auto blacklist the Server sending high score spam mail to the server.
http://forums.rvskin.com/index.php?s=&show...findpost&p=4739

[takeover]

i wouldn't mind so much if it just stoped blocking spam during the high load

the problem is it crashes exim and makes it impossible to send mail

[graziano]

I anzlyzed the panic_log and I have exactly the same problem

2006-11-16 08:06:42 1Gkgx0-000240-5U spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused
2006-11-16 08:06:42 1Gkgx0-000240-5U spam acl condition: all spamd servers failed
2006-11-16 08:06:42 1Gkgx0-000240-5U spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused
2006-11-16 08:06:42 1Gkgx0-000240-5U spam acl condition: all spamd servers failed
2006-11-16 08:07:13 1GkgxU-0002AP-VY spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused
2006-11-16 08:07:13 1GkgxU-0002AP-VY spam acl condition: all spamd servers failed
2006-11-16 08:07:13 1GkgxU-0002AP-VY spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused
2006-11-16 08:07:13 1GkgxU-0002AP-VY spam acl condition: all spamd servers failed
2006-11-16 08:07:13 1GkgxU-0002AP-VY spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused
2006-11-16 08:07:13 1GkgxU-0002AP-VY spam acl condition: all spamd servers failed

each time I restart exim service I receive this

apparently all works fine .

[4uh]

Having same problem

2006-11-22 04:03:28 1GmjKP-0000kF-4N spam acl condition: cannot parse spamd output
2006-11-22 04:03:28 1GmjKP-0000kF-4N spam acl condition: error reading from spamd socket: Connection reset by peer
2006-11-22 04:03:28 1GmjKP-0000kF-4N spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused
2006-11-22 04:03:28 1GmjKP-0000kF-4N spam acl condition: all spamd servers failed

Server load is fine.