Nicolas Wegener wrote:
> On 11/15/06, Eric Shubes <[EMAIL PROTECTED]> wrote:
>> Nicolas Wegener wrote:
>> > On 11/15/06, Eric Shubes <[EMAIL PROTECTED]> wrote:
>> >> Nicolas Wegener wrote:
>> >> > On 11/15/06, Eric Shubes <[EMAIL PROTECTED]> wrote:
>> >> >> Nicolas Wegener wrote:
>> >> >> > Hello all,
>> >> >> >
>> >> >> > I have been polling my hair out trying to fix this problem.
>> >> Emails are
>> >> >> > taking for ever to get to my server, I believe I have pin pointed
>> >> the
>> >> >> > problems, however I cannot find whats wrong with my install.
>> >> >> >
>> >> >> > I've been using qmail-toaster on this domain for about a year now
>> >> & I
>> >> >> > love it (good work guys). However I had to upgrade to fc5, in the
>> >> >> > process I had to remove the qmail-toaster rpms. After backing
>> >> >> > everything up reinstalling qmail-toaster I'm stuck with a
>> "filtered"
>> >> >> > smtp socket (according to nmap) runing on the host. I checked the
>> >> >> > process list 'ps -AH' & I have a zillion "qmail-smtpd ->
>> simscan ->
>> >> >> > spamc". I've been back & forth with the built in firewall
>> (which I
>> >> >> > really don't like), It's currently disabled and at this point
>> >> there is
>> >> >> > no firewall between the server and outside world.
>> >> >> >
>> >> >> > if anyone has any clue as to what I did wrong... Just let me
>> know...
>> >> >> > If you need to see some other file... Just let me know...
>> Thanks in
>> >> >> > advance for your help.
>> >> >> >
>> >> >> > I've included tcp.smtp, my process list, & the nmap results.
>> >> >> >
>> >> >> > The host is "renslowssystems.com"
>> >> >> >
>> >> >> <snip>
>> >> >>
>> >> >> I'm guessing that SA is having problems. I would:
>> >> >>
>> >> >> .) Verify permissions (vpopmail:vchkpw) on
>> >> /home/vpopmail/.spamassassin/*
>> >> >> .) # qmailctl stop
>> >> >> .) kill any zombied processes (qmail-smtp, spamc)
>> >> >> .) # sudo -u vpopmail -H spamassassin -D --lint
>> >> >> .) # sa-learn -u vpopmail --force-expire
>> >> >>
>> >> >> Let us know if that clears things up or not.
>> >> >> --
>> >> >> -Eric 'shubes'
>> >> >>
>> >> >
>> >> > Eric,
>> >> >
>> >> > Thanks for the quick reply... it's appreciated greatly. However I
>> ran
>> >> > the above commands & my two problems (filtered socket... & endless
>> >> > amounts of smtpd processes) still exist. I'll try running them
>> again,
>> >> > but do you got any other ideas?
>> >> >
>> >> > -Nic
>> >> >
>> >>
>> >> We'll, that doesn't eliminate SA entirely, but it narrows things down
>> >> a bit.
>> >> I doubt that running them again will help. They should have sync'd the
>> >> bayes
>> >> journal and run any due expirations.
>> >>
>> >> Are you seeing anything unusual in the smtp and spamd logs?
>> >>
>> >> --
>> >> -Eric 'shubes'
>> > -----------------
>> > - Spamd Log
>> > -----------------
>> > @400xx [9075] info: spamd: connection from localhost.localdomain
>> > [127.0.0.1] at port 43465
>> > @400xx [9075] info: spamd: processing message
>> > <[EMAIL PROTECTED]> for clamav:89
>> > @400xx [8840] info: spamd: clean message (4.4/5.0) for clamav:89 in
>> > 8.5 seconds, 23804 bytes.
>> > @400xx info: spamd: result: . 4 -
>> >
>> AWL,BAYES_50,DATE_IN_PAST_03_06,FB_LIKE_NIGERIA,FM_NO_STYLE,HTML_IMAGE_ONLY_20,HTML_MESSAGE,NO_REAL_NAME
>>
>> >
>> >
>> scantime=8.5,size=23804,user=clamav,uid=89,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=43460,mid=<[EMAIL
>> PROTECTED]>,bayes=0.439404919280519,autolearn=no
>>
>> >
>> > @400xx [8382] info: prefork: child states: BBBBB
>> > @400xx [8382] info: prefork: server reached --max-children setting,
>> > consider raising it
>> > -----------------
>> > - End Of Spamd Log
>> > -----------------
>> >
>> > I'm assuming that "server reached --max-children setting, consider
>> > raising it" is from all the processes? That statement along with the
>> > one above it "child states: BBBBBB" is all over the spamd log... as
>> > far as I can tell it's on every listing in the log. The smtp log shows
>> > emails coming in... but has no errors/warnings.
>> >
>> > Any thoughts?
>> >
>> > -Nic
>> >
>>
>> SA appears to be having a problem all right. I wouldn't up
>> max-children, as
>> they suck up a ton of ram and you'll just start paging which will make
>> things worse.
>>
>> I'm guessing that you're not running local only rules (-L option in
>> the run
>> file). If so, I'd add the -L option back in for the time being.
>> That'll make
>> your spam detection a little less effective for the moment, but I'm
>> guessing
>> mail will start flowing again.
>>
>> If mail flows using the -L option, my guess is that you have a DNS
>> configuration problem.
>>
>> Let us know...
>> --
>> -Eric 'shubes'
>>
>
> Eric you are a genius! DNS is the issue here... I removed some domains
> MX's so it wouldn't point to the mail server for the time being. The
> point is; nmap shows the port open... However I still have a huge
> process list of smtpd... but no simscan & spamc... I still have no
> clue as to why the child list is so large... but the DNS is certainly
> effecting it.
>
> Thanks again for all your help.
>
Thanks, but even a blind squirrel finds a nut now and then. ;)
Your smtpd processes are backing up because the RBLs are taking a while to
process, and spamc was slow because of SURBL lookups (presuming you turned
that on).
Your caching nameserver (you are running one, aren't you?) is apparently not
doing it's thing.
What do you get for
# service named status
(presuming you're running bind)
# cat /etc/resolv.conf
?
--
-Eric 'shubes'
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
