On Mon, 16 Jun 2003, Simon Byrnand wrote: > At 21:54 15/06/03 -0400, Jack Gostl wrote: > >On Mon, 16 Jun 2003, Simon Byrnand wrote: > > > > > At 18:22 15/06/03 -0400, Jack Gostl wrote: > > > > > > >I just had a piece of spam slip through with no X-header. When I saved it, > > > >and manually ran it through "spamc -R" it got something like a 17. > > > > > > > >By now I've run tens of thousands of messages through spamc/spamd and, > > > >except for OS crashes, this is the first one I've seen that was obviously > > > >not processed > > > > > > > >Any thoughts on what happened? > > > > > > Bigger than 256KB ? > > > > > > (spamc wont scan messages bigger than this by default but spamassassin > > will) > > > >Nope. About 1200 bytes. Besides, it works when I piped it into "spamc -R". > > Ok, in that case most likely spamc timed out trying to get a connection to > spamd, in which case it automatically fails over to passing the message > through unscanned. Check your maillog file for error messages from spamc > that look something like: > > spamc[15549]: connect() to spamd at 127.0.0.1 failed, retrying (1/3): > Connection refused > > This could happen if the number of simultaneous spamc attempts was above > the maxchildren setting of spamd for a prolonged period of time, or if > spamd just couldn't reply fast enough on a bogged down machine....
Nope - That was one of the first things I thought of. Nothing like that today, plus the machine wasn't particularly busy at that time. Its always possible that the syslog was swamped and messages were lost, but I doubt it, it wasn't that busy. Using Pine, I checked the message ID and scanned the syslog (which includes both spamd and sendmail entries) and located the message being handed off to procmail. It wasn't even slightly busy at that time. I also considred that procmail might have screwed up and bypassed spamd, but I don't see anything in the message that hinted at that. Want to see the spam in question? I could send it as an attachment. -- Jack Gostl [EMAIL PROTECTED] ------------------------------------------------------- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
