mailog file 50-90 Gb / day due to spamd

I

infiltrator

Verified User
Joined
Jun 8, 2006
Messages
41
For several times i got a wrning that my partition space is getting critical.

After looking into the problem the maillog file seems to be the problem.
The file gets 50Gb big and more.

Once our server got down becorse the file got to big.

Setting log rotate to a max file size does not solve the problem.

Monitoring the file --> some days everything seems ok and the file is not getthing bigger then some Mb.
But sometimes it goes wild and getting bigger like 100Mb in 2-3 minutes.

When digging into the file when its not to big...
the maillog goes crazy with following lines over and over
Code: 
Jan 22 09:34:38 verv01 spamd[29650]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN19> line 45. 
Jan 22 09:34:38 verv01 spamd[29648]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN22> line 192. 
Jan 22 09:34:38 verv01 spamd[29650]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN19> line 45. 
Jan 22 09:34:38 verv01 spamd[29648]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN22> line 192. 
Jan 22 09:34:38 verv01 spamd[29650]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN19> line 45. 
Jan 22 09:34:38 verv01 spamd[29650]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN19> line 45.

Cant find a simuler problem or a solution for it on internet.

Somebody an idea how to solve it ?

I already run upgrades, but does not fix it.

Restarting the exim and dovecot service stopts the problem, for a moment , sometime for a day or 2 some times for some minutes...

The lines just before the problem starts
Code: 
Jan 22 09:34:37 verv01 spamd[29650]: send() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 218, <GEN19> line 45. 
Jan 22 09:34:37 verv01 spamd[29650]: dns: sendto() failed: Bad file descriptor at /usr/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/DnsResolver.pm line 411, <GEN19> line 45. 
Jan 22 09:34:37 verv01 spamd[29650]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN19> line 45. 
Jan 22 09:34:38 verv01 last message repeated 2946 times
Jan 22 09:34:38 verv01 spamd[29648]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN22> line 192. 
Jan 22 09:34:38 verv01 last message repeated 471 times
Jan 22 09:34:38 verv01 spamd[29650]: recv() on closed socket GEN6 at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/IO/Socket.pm line 236, <GEN19> line 45.
 
You might want to try updating the plugins it if it is outdated.

How did you install spamassassin?

Try to upgrade it with custombuild.
 
chatwizrd said:
You might want to try updating the plugins it if it is outdated.

How did you install spamassassin?

Try to upgrade it with custombuild.
Click to expand...

We hire an dedicated server with directadmin and spamassasin pre installed.

I updated the whole server through yum update and after that i checked for updates through custombuild, but nothing needed to be updated through custombuild.
 
chatwzrd
your suggestion made me re check.
i found out that in custombuild the spamassasin was not set to update. I changed it and updated it.
There was a newer version, so hopefully it fixed my problem.

Thx for the suggestion
 
The update of spamassasin to the latest version, did not solve the problem. this morning was the maillog file over 38 Gb and climbing.
I'm trying to monitor the file to the point where it goes wrong again , so i can download again and spot the problem after the update.
 
You should turn on log rotate for that log. You should never let a log grow that big.

You must have some other dns problem on your server.

Can you lookup hosts fine with the host and dig commands.

Are your settings right in /etc/resolv.conf and /etc/hosts
 
Last edited:
chatwizrd said:
You should turn on log rotate for that log. You should never let a log grow that big.

You must have some other dns problem on your server.

Can you lookup hosts fine with the host and dig commands.

Are your settings right in /etc/resolv.conf and /etc/hosts
Click to expand...

Log rotate is on for that file, run once a day and filsize of max 1Gb or less , i schould check.

The other things i should check.

But when running normaly, the maillog never gets bigger then a few Mb. or even less then a Mb.

Making the logrotate run more frequent, will preventing the server gething down due to no more space left, but wont solve the cause of the problem.
 
As an interim fix you might want to tell spamassassin to log to a null directory:
Code: 
/dev/null
Jeff
 
For 2 days now, everything seems fine.
log not getthing bigger then 50Kb
I'm going to monitor it for some days and see what happens, if everything goes crazy again i'm going to check that mailing list.

Thx for the help
 
You must log in or register to reply here.
Back
Top