On Wed, 8 Oct 2025, Matija Nalis wrote:
Is dccifd even running?
Yes. Because it's producing these logs when SA disconnects. These are
dccifd logs, not spamd logs.
If so, and it doesn't produce any logs of its
own, I'd do "strace -ff -tt -p `pidof dccifd`" to try to see where it fails
dccifd is producing *these* logs.
What I am pretty sure is happening is that we have the "shortcircuit"
plugin installed, and so if a shortcircuit=spam fires, it hangs up on
dccifd without properly closing the connection.
Any ideas as to how to tell SA not to shortcircuit this, or how to close
the dccifd connection in a more clean way?
(Note: our chain is postfix --> spamass-milter --> spamc --> spamd -->
dccifd)
Here are some logs that correlate this (look at the times)
root@post:/var/log # bzcat maillog.1.bz2 | grep shortcircuit=spam
Oct 9 07:25:43 post spamd[15574]: spamd: result: Y 111 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,URIBL_CSS_A,URIBL_DBL_SPAM
scantime=0.1,size=15312,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=16731,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct 9 07:25:43 post spamd[15575]: spamd: result: Y 114 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,URIBL_CSS_A,URIBL_DBL_SPAM,URIBL_ZRD
scantime=0.1,size=15297,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=45408,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct 9 07:25:43 post spamd[15574]: spamd: result: Y 114 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,URIBL_CSS_A,URIBL_DBL_SPAM,URIBL_ZRD
scantime=0.1,size=15252,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=15343,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct 9 11:02:01 post spamd[19633]: spamd: result: Y 119 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SH_DBL_HEADERS,SPF_HELO_NONE,SPF_PASS,URIBL_BLACK,URIBL_DBL_SPAM
scantime=0.1,size=6408,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=49587,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct 9 14:14:31 post spamd[21403]: spamd: result: Y 122 -
ARC_SIGNED,ARC_VALID,DCC_CHECK,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SH_DBL_HEADERS,SH_HELO_DBL,SPF_HELO_NONE,SPF_PASS,URIBL_CSS_A,URIBL_DBL_SPAM
scantime=1.9,size=13920,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=51870,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct 9 15:13:23 post spamd[22657]: spamd: result: Y 112 -
ARC_SIGNED,ARC_VALID,DCC_CHECK,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_HOSTKARMA_BL,RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SPF_HELO_NONE,SPF_PASS,URIBL_ABUSE_SURBL,URIBL_BLACK,URIBL_CSS_A
scantime=1.8,size=18031,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=46568,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct 9 17:33:56 post spamd[24144]: spamd: result: Y 116 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SH_DBL_HEADERS,SPF_HELO_NONE,SPF_PASS,URIBL_CSS_A,URIBL_DBL_SPAM
scantime=0.1,size=16734,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=37243,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct 9 20:29:25 post spamd[25497]: spamd: result: Y 108 -
DCC_CHECK,RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_XBL,RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SPF_HELO_SOFTFAIL,SPF_SOFTFAIL
scantime=1.5,size=4500,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=31880,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct 9 20:44:40 post spamd[25497]: spamd: result: Y 114 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SPF_HELO_NONE,SPF_PASS,URIBL_DBL_ABUSE_PHISH,URIBL_DBL_PHISH
scantime=0.1,size=21506,user=xxxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=28473,mid=<8as9v5vaS6GVCwWHd_SB4A@geopod-ismtpd-36>,autolearn=disabled,shortcircuit=spam
Oct 9 20:44:51 post spamd[25497]: spamd: result: Y 105 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT
scantime=0.1,size=21420,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=49326,mid=<3RSz7P7CRjWuVuHqWVWO9A@geopod-ismtpd-2>,autolearn=disabled,shortcircuit=spam
Oct 9 20:45:04 post spamd[25497]: spamd: result: Y 111 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,URIBL_DBL_PHISH,URIBL_GREY
scantime=0.1,size=21257,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=61028,mid=<TYwjFL6OR2WpClDiLD-EeA@geopod-ismtpd-13>,autolearn=disabled,shortcircuit=spam
Oct 9 20:45:42 post spamd[25497]: spamd: result: Y 114 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SPF_HELO_NONE,SPF_PASS,URIBL_DBL_ABUSE_PHISH,URIBL_DBL_PHISH
scantime=0.1,size=21867,user=cathy_almond,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=54166,mid=<6DFxvdpzTd2qixRVEvOnaQ@geopod-ismtpd-25>,autolearn=disabled,shortcircuit=spam
root@post:/var/log # bzcat maillog.1.bz2 | grep dccifd
Oct 9 00:00:00 post dccifd[834]: 2.3.168 detected 0 spam, ignored for 0,
rejected for 0, and discarded for 0 targets among 0 total messages for
3225 targets since 10/08/25 00:00:00
Oct 9 07:25:43 post dccifd[834]: write(MTA socket,820): Broken pipe
Oct 9 07:25:43 post dccifd[834]: write(MTA socket,820): Broken pipe
Oct 9 07:25:43 post dccifd[834]: write(MTA socket,822): Broken pipe
Oct 9 11:02:02 post dccifd[834]: write(MTA socket,843): Broken pipe
Oct 9 17:33:56 post dccifd[834]: write(MTA socket,840): Broken pipe
Oct 9 20:44:41 post dccifd[834]: write(MTA socket,840): Broken pipe
Oct 9 20:44:51 post dccifd[834]: write(MTA socket,840): Broken pipe
Oct 9 20:45:05 post dccifd[834]: write(MTA socket,840): Broken pipe
Oct 9 20:45:43 post dccifd[834]: write(MTA socket,840): Broken pipe
-Dan
--
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
FB: fb.com/DanielMahoneyIV
LI: linkedin.com/in/gushi
Site: http://www.gushi.org
---------------------------
