Pkg exim4 users - Oct 2008 - exim paniclog on thelma has non-zero size

I got this error in the panic log.

2008-10-03 15:17:21 1Klq15-0003wz-TM spam acl condition: error reading 
from spam
d socket: Connection timed out

Nothing since that date and time.

Is it something I should be concerned about?

-- 
Robert Steinmetz, AIA
Principal
Steinmetz & Associates

Robert Steinmetz AIA wrote:
> I got this error in the panic log.
> 
> 2008-10-03 15:17:21 1Klq15-0003wz-TM spam acl condition: error reading 
> from spam
> d socket: Connection timed out
> 
> Nothing since that date and time.
> 
> Is it something I should be concerned about?
Looks like spamd is not responding or running anymore on your system. 
Not sure what port it''d be on, try to scan your system using nmap or 
netstat, restart spamd (is that spamassassin?).

Greetings,
Jeroen

Robert Steinmetz AIA wrote:
> I got this error in the panic log.
Also, if exim is still working fine there isn''t really a problem 
anymore. If on the other hand it failed to start then you should try to 
fix what the log complains about.

On Tue, 2008-10-07 at 13:08 -0500, Robert Steinmetz AIA
wrote:
> I got this error in the panic log.
> 
> 2008-10-03 15:17:21 1Klq15-0003wz-TM spam acl condition: error reading 
> from spam
> d socket: Connection timed out
> 
> Nothing since that date and time.
> 
> Is it something I should be concerned about?
I see such warnings fairly routinely.  I have always taken then to mean
that spamd got momentarily overloaded, and things seem to proceed OK
after that.  However, I have a feeling they indicate some problem that I
just haven''t been able to identify.  And I don''t really know
what''s
going on.
Ross Boylan
-- 
Ross Boylan                                      wk:  (415) 514-8146
185 Berry St #5700                               ross at biostat.ucsf.edu
Dept of Epidemiology and Biostatistics           fax: (415) 514-8150
University of California, San Francisco
San Francisco, CA 94107-1739                     hm:  (415) 550-1062

Ross Boylan wrote:
> On Tue, 2008-10-07 at 13:08 -0500, Robert Steinmetz AIA wrote:
>> I got this error in the panic log.
>>
>> 2008-10-03 15:17:21 1Klq15-0003wz-TM spam acl condition: error reading 
>> from spam
>> d socket: Connection timed out
>>
>> Nothing since that date and time.
>>
>> Is it something I should be concerned about?
> I see such warnings fairly routinely.  I have always taken then to mean
> that spamd got momentarily overloaded, and things seem to proceed OK
> after that.  However, I have a feeling they indicate some problem that I
> just haven''t been able to identify.  And I don''t really
know what''s
> going on.
I started getting a spate of these a couple months ago and looked into 
it.  What was happening was I was getting some really large spam 
messages (lots of embedded images.)  SpamAssassin was taking a long time 
to scan those, which meant that if several arrived in close succession 
eventually all the spamd instances were busy and these messages started 
appearing.

What I did was modify my spam ACLs so that "big" messages
didn''t get
scanned by SpamAssassin:

   deny
     condition = ${if < {$message_size}{50K}}
     message = This message scored $spam_score spam points
     spam = Debian-exim
     condition = ${if >{$spam_score_int}{75}{1}{0}}

This drastically reduced the incidence of the paniclog messages, at the 
cost of a few extra spam messages in inboxes.   I still got an 
occasional paniclog message, which I attributed to just momentary bursts 
of traffic. I upgraded the server hardware and I haven''t seen the 
paniclog messages since, but that''s only been a week or so.

Rich

Ross Boylan wrote:
> On Tue, 2008-10-07 at 13:08 -0500, Robert Steinmetz AIA wrote:
>   
>> I got this error in the panic log.
>>
>> 2008-10-03 15:17:21 1Klq15-0003wz-TM spam acl condition: error reading 
>> from spam
>> d socket: Connection timed out
>>
>> Nothing since that date and time.
>>
>> Is it something I should be concerned about?
>>     
> I see such warnings fairly routinely.  I have always taken then to mean
> that spamd got momentarily overloaded, and things seem to proceed OK
> after that.  However, I have a feeling they indicate some problem that I
> just haven''t been able to identify.  And I don''t really
know what''s
> going on.
> Ross Boylan
>   
That is what I think also. Either spamd or the whole system is 
momentarily overloaded, although I see no other indication of that. I 
would expect an error different than a "time out" if spamd were not 
running. I''d expect something like "unable to connect". When
I check it
is running.

I haven''t gotten this error since 10/3, shortly after I cleared all of 
the logs and did some minor reconfiguration. Like you I''m concerned it 
may indicate some other underlying problem.

So far no identifiable problem with mail delivery. I may look into 
improving the mail system performance.

-- 
Robert Steinmetz, AIA
Principal
Steinmetz & Associates

I sometimes get these messages, always at the time when cron.daily gets
run.  No big problem, but it''s still annoying.  Any good tip on how to
avoid (reports of) spamassassin unavailability during the cron run?

Milan Zamazal