Hi,
The thing that immediately caught my eye was the fact that in a line
such as:
Apr 2 10:31:26 oss2 spamfilter: Sat Oct 15 15:20:22 2016 [2758] info:
spamd: connection from ip6-localhost [::1]:55708 to port 783, fd 5
There are 2 timestamps, far away from each other. After some pondering,
my guess is that spamfilter.sh is writing away log lines to a temporary
file for each delivery, and them spewing them again when handling is
complete. But there is a bug where spamfilter.sh does not cleanup after
itself, and new lines are appended to the existing temporary file, and
then the complete contents of the file are sent to syslog. Thus for each
single delivery the logging for all messages in the past half year (Oct
15 -> Apr x) is sent to syslog.
Please post the full contents of the spamfilter.sh, and examine the
contents of any temporary files that is it using.
Kind regards,
Tom
On 04-04-17 23:09, Jim McLachlan wrote:
> Hi,
>
> I have a problem with the huge amount of messages being logged by
> spamassassin. I have around 10 active e-mail users on the system, none
> of whom have any unusual e-mail usage. This is what I've seen in the
> last 2 hours:
>
> $ date
> Mon 3 Apr 08:00:50 UTC 2017
>
> $ ls -l /var/log/mail.log
> -rw-r----- 1 syslog adm 86370829860 Apr 3 08:00 /var/log/mail.log
> -rw-r----- 1 syslog adm 331608479025 Apr 2 09:20 /var/log/mail.log.1
>
>
> $ spamassassin --version
> SpamAssassin version 3.4.1
> running on Perl version 5.22.1
>
> My set up consists of Postfix, Postgrey, Spamassassin, Clam-AV,
> Amavis-new and Dovecot.
>
> When I send an e-mail through the system, it immediately starts
> churning out a long list of log messages that implies it's checking
> messages from last October (when I set up the server). It goes through
> thousands of messages like this and then settles down again until
> another e-mail is processed.
>
> My initial e-mail with attachment didn't work, so an excerpt from
> the log file can be found here:
>
> http://pasted.co/5e546e7a
>
> Can someone please explain to me why it's repeating all this work
> and all these messages for every e-mail that gets processed and what I
> can do to fix this. I reduced the problem slightly yesterday by
> preventing all these messages getting logged to syslog at the same time.
>
> Kind regards.
>
> Jim.
