Timeout?, How is this possible?

[voigt]

I rebooted my mail server recently and now getting more spam than normal is getting through. I did a little research and found that there is a copy in my spam directory that matches the spam that got through but has the Spamassassin headers added and is marked as spam. Is there some kind of timeout that we're just reaching where the server (XMail 1.24) thinks the filter died and delivers the mail, then the filter finishes and sticks the message in the spam folder too? Where would I up the filter time to test my theory? More importantly, what might I have changed that would make the filters take just a little longer to cause this. Mind you, I'm getting thousands of spams a day and only 3-4 are getting through but that's up from maybe 1-2 a week.

Spamassassin is version 3.2.5, perl is version 5.8.8 and xspamc is the filter code for this filter.

TIA for any ideas,

John

[voigt]

Never mind, xspamc logs how long each filter process took. My filter timeout was 60 seconds (-QT 60) and I found the spam in the table took 65.19 seconds to process. I've bumped the filter time back up to 90 (not sure why I ever lowered it.) Still doesn't explain why the filters are suddenly taking longer. Any ideas? The server was up for over a year since I last rebooted it so many things could have changed.

[hschneider]

Maybe the kind or the nimber of spam changed, your machine resources went low etc.
Monitor it a while with the 'top' command and see if there is still enough RAM or if there are any scpamc zombie processes.

[voigt]

No, this doesn't look like load. I just took a look at some old logs and most of the time the filters were finishing in under 2 seconds. Now they are averaging 40-50 seconds and sometimes as much as 120. I've bumped my filter time up to 180 and the spam is gone but I still don't understand what SpamAssassin is doing that's taking so long now. I guess I'm going to have to run some traces to see if I can find the delay.

Spamc from the command line is also very slow.

John

[voigt]

OK - well this one's solved. named didn't start up for some reason so I had no local nameserver that was working. /etc/resolv.conf had 127.0.0.1 as it's first entry so there was a 30 second timeout on every DNS lookup.

I'm still not sure why bind9 didn't start but I'll nail that one down shortly. Sorry for the noise.

John

[hschneider]

No problem, I'm sure your feedback here will help others.