Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: exim: users

Spamd Timeout

 

 

exim users RSS feed   Index | Next | Previous | View Threaded


itooo at itooo

Dec 14, 2009, 3:58 PM

Post #1 of 4 (894 views)
Permalink
Spamd Timeout

Hi,

My Exim (version 4.69) sometimes generates "spam acl condition: error
reading from spamd socket: Connection timed out" messages in the mainlog.
When I match this error with spamassassin's log I read very long scan
times (> 120s).

The server is not really heavily loaded.

Before considering removing some scan options in spamassassin, I'd
rather like to raise exim's timeout to spamd's answer.

I could not find any parameter to adjust this timeout and all the
messages I read about this problem offer to raise the --max-children
parameter of spamassassin as a solution. I'm pretty sure this is not the
solution here.

Is this spamd timeout hard coded ? Is there a workaround ?

Thank you very much

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


jethro.binks at strath

Dec 14, 2009, 4:24 PM

Post #2 of 4 (839 views)
Permalink
Re: Spamd Timeout [In reply to]

On Tue, 15 Dec 2009, Greg wrote:

> My Exim (version 4.69) sometimes generates "spam acl condition: error
> reading from spamd socket: Connection timed out" messages in the
> mainlog. When I match this error with spamassassin's log I read very
> long scan times (> 120s).
>
> The server is not really heavily loaded.
...
> I could not find any parameter to adjust this timeout and all the
> messages I read about this problem offer to raise the --max-children
> parameter of spamassassin as a solution. I'm pretty sure this is not the
> solution here.
>
> Is this spamd timeout hard coded ? Is there a workaround ?

Unfortunately, perhaps, it appears so, in spam.h:

/* timeout for reading and writing spamd */
#define SPAMD_TIMEOUT 120

I had recently noticed something similar for with the malware scanners
too, in malware.h:

#define MALWARE_TIMEOUT 120

Some flexibility here would indeed be handy.

However, to address your actual problem, if your server is not heavily
loaded, there is probably a good reason for the scan taking so long. If
it happens very often, maybe you are suffering from DNS timeout issues or
suchlike? Sometimes messages can be badly formed in a way that
SpamAssassin doesn't like them (although I do not use the spamd interface
directly from Exim in my environment). If you are doing image processing,
then that can be resource-intensive.

If you increase the timeout so you have exims hanging around for longer
waiting for spamd, you have to consider if your mail server is going to be
able to keep up, or is mail just going to start backing up?

Jethro.


. . . . . . . . . . . . . . . . . . . . . . . . .
Jethro R Binks
Computing Officer, IT Services, University Of Strathclyde, Glasgow, UK

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


hs at schlittermann

Dec 14, 2009, 4:25 PM

Post #3 of 4 (832 views)
Permalink
Re: Spamd Timeout [In reply to]

Hello,
Greg <itooo [at] itooo> (Di 15 Dez 2009 00:58:16 CET):
> Hi,
>
> My Exim (version 4.69) sometimes generates "spam acl condition: error
> reading from spamd socket: Connection timed out" messages in the mainlog.
> When I match this error with spamassassin's log I read very long scan
> times (> 120s).
>
> The server is not really heavily loaded.
>
> Before considering removing some scan options in spamassassin, I'd
> rather like to raise exim's timeout to spamd's answer.
>
> I could not find any parameter to adjust this timeout and all the
> messages I read about this problem offer to raise the --max-children
> parameter of spamassassin as a solution. I'm pretty sure this is not the
> solution here.
>
> Is this spamd timeout hard coded ? Is there a workaround ?

I don't know if there is a timeout option for the spamd connection, but
the workaround could be to restrict the messages sent to spamd based on
the size of the message. (We use a upper limit of 512k).

Best regards from Dresden/Germany
Viele Grüße aus Dresden
Heiko Schlittermann
--
SCHLITTERMANN.de ---------------------------- internet & unix support -
Heiko Schlittermann HS12-RIPE -----------------------------------------
gnupg encrypted messages are welcome - key ID: 48D0359B ---------------
gnupg fingerprint: 3061 CFBF 2D88 F034 E8D2 7E92 EE4E AC98 48D0 359B -
Attachments: signature.asc (0.19 KB)


itooo at itooo

Dec 16, 2009, 1:07 AM

Post #4 of 4 (823 views)
Permalink
Re: Spamd Timeout [In reply to]

Jethro R Binks a écrit :
> On Tue, 15 Dec 2009, Greg wrote:
>
> Unfortunately, perhaps, it appears so, in spam.h:
>
> /* timeout for reading and writing spamd */
> #define SPAMD_TIMEOUT 120
>
> I had recently noticed something similar for with the malware scanners
> too, in malware.h:
>
> #define MALWARE_TIMEOUT 120
>
> Some flexibility here would indeed be handy.
>
>
Agreed, my Exim is installed from a debian package and I have no
intention to recompile it. Perhaps I don't even have enough knowledge to
do that properly.

> However, to address your actual problem, if your server is not heavily
> loaded, there is probably a good reason for the scan taking so long.
> If it happens very often, maybe you are suffering from DNS timeout
> issues or suchlike? Sometimes messages can be badly formed in a way
> that SpamAssassin doesn't like them (although I do not use the spamd
> interface directly from Exim in my environment). If you are doing
> image processing, then that can be resource-intensive.
>
You are right, but this happens twice a month and I couldn't find how to
freeze the message to reproduce the problem and find out why it take so
much time to analyze these messages.
> If you increase the timeout so you have exims hanging around for
> longer waiting for spamd, you have to consider if your mail server is
> going to be able to keep up, or is mail just going to start backing up?
>
>
Increasing the timeout to 5 minutes should be ok I guess.


PS: sorry Jethro, I replied to you instead of the mailing list.
--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

exim users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.