Mailing List Archive: Spamassassin spamming in log

Spamassassin spamming in log

Jun 2, 2022, 5:33 AM

Post #1 of 14 (1311 views)

Hi all,

I have a running debian 11 with postfix/dovecot and Amavis with clamav /
spamassassin.
I saw that the spamassassin logfile is growing very fast and found the
following entries occuring many times per second.
Can you maybe help me to get this fixed?
I searched along the internet but did not find really a solution.
Do you need any config files to check?

Thanks for your help in advance,
Timo

Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of child
pid [1849690] due to SIGCHLD: exit 255
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of child
pid [1849691] due to SIGCHLD: exit 255
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of child
pid [1849692] due to SIGCHLD: exit 255
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of child
pid [1849693] due to SIGCHLD: exit 255
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
spawned child process, pid 1849698
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of child
pid [1849696] due to SIGCHLD: exit 255
Thu Jun 2 11:43:11 2022 [1849698] error: spamd: cannot run as
nonexistent user or root with -u option
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
spawned child process, pid 1849699
Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SS
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
spawned child process, pid 1849700
Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
children less than 1 minimum idle children. Increasing spamd children:
1849700 started.
Thu Jun 2 11:43:11 2022 [1849699] error: spamd: cannot run as
nonexistent user or root with -u option
Thu Jun 2 11:43:11 2022 [1849700] error: spamd: cannot run as
nonexistent user or root with -u option
Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSS
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
spawned child process, pid 1849701
Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
children less than 1 minimum idle children. Increasing spamd children:
1849701 started.
Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSSS
Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
spawned child process, pid 1849702
Thu Jun 2 11:43:11 2022 [1849701] error: spamd: cannot run as
nonexistent user or root with -u option
Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
children less than 1 minimum idle children. Increasing spamd children:
1849702 started.
Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSSSS

Re: Spamassassin spamming in log [ In reply to ]

bert at ulyssis

Jun 2, 2022, 5:47 AM

Post #2 of 14 (1311 views)

Permalink

For the errors about nonexistent uses you will want to have a look at
/etc/default/spamassassin I'm guessing.
For the info messages: this has just got to do with your logging level.
You will want to decrease it in local.cf or maybe also in the default file.

On 2/06/2022 14:33, Timo Brandt wrote:
> Hi all,
>
> I have a running debian 11 with postfix/dovecot and Amavis with clamav
> / spamassassin.
> I saw that the spamassassin logfile is growing very fast and found the
> following entries occuring many times per second.
> Can you maybe help me to get this fixed?
> I searched along the internet but did not find really a solution.
> Do you need any config files to check?
>
> Thanks for your help in advance,
> Timo
>
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849690] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849691] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849692] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849693] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849698
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849696] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1849698] error: spamd: cannot run as
> nonexistent user or root with -u option
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849699
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SS
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849700
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
> children less than 1 minimum idle children. Increasing spamd children:
> 1849700 started.
> Thu Jun 2 11:43:11 2022 [1849699] error: spamd: cannot run as
> nonexistent user or root with -u option
> Thu Jun 2 11:43:11 2022 [1849700] error: spamd: cannot run as
> nonexistent user or root with -u option
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSS
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849701
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
> children less than 1 minimum idle children. Increasing spamd children:
> 1849701 started.
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSSS
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849702
> Thu Jun 2 11:43:11 2022 [1849701] error: spamd: cannot run as
> nonexistent user or root with -u option
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
> children less than 1 minimum idle children. Increasing spamd children:
> 1849702 started.
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSSSS
>
>

Re: Spamassassin spamming in log [ In reply to ]

mail at timo-brandt

Jun 2, 2022, 5:57 AM

Post #3 of 14 (1311 views)

Permalink

Hi Bert,

many thanks for your answer.

Please find the spamassassin config below.

I already checked it but do not find anything to change which is
stopping the flooding.

Also, spamassassin is consuming mostly all of my CPU power.

When its running, the CPU is nearly the whole time at 99%. When I stop
spamassassin, the CPU consumption is going down.

# /etc/default/spamassassin
# Duncan Findlay

# WARNING: please read README.spamd before using.
# There may be security risks.

# Prior to version 3.4.2-1, spamd could be enabled by setting
# ENABLED=1 in this file. This is no longer supported. Instead, please
# use the update-rc.d command, invoked for example as "update-rc.d
spamassassin enable", to enable the spamd service.

# Options
# See man spamd for possible options. The -d option is automatically
added.
ENABLED=1
# SpamAssassin uses a preforking model, so be careful! You need to
# make sure --max-children is not set to anything higher than 5,
# unless you know what you're doing.
OPTIONS="--create-prefs --max-children 5 --helper-home-dir --username
spamd --helper-home-dir /home/spamd -s /var/log/spamassassin/spamd.log

# Pid file
# Where should spamd write its PID to file? If you use the -u or
# --username option above, this needs to be writable by that user.
# Otherwise, the init script will not be able to shut spamd down.
PIDFILE="/var/run/spamd.pid"

# Set nice level of spamd
#NICE="--nicelevel 15"

# Cronjob
# Set to anything but 0 to enable the cron job to automatically update
# spamassassin's rules on a nightly basis
CRON=1

Am 2022-06-02 14:47, schrieb Bert Van de Poel:

> For the errors about nonexistent uses you will want to have a look at
> /etc/default/spamassassin I'm guessing.
> For the info messages: this has just got to do with your logging level.
> You will want to decrease it in local.cf or maybe also in the default
> file.
>
> On 2/06/2022 14:33, Timo Brandt wrote:
>
>> Hi all,
>>
>> I have a running debian 11 with postfix/dovecot and Amavis with clamav
>> / spamassassin.
>> I saw that the spamassassin logfile is growing very fast and found the
>> following entries occuring many times per second.
>> Can you maybe help me to get this fixed?
>> I searched along the internet but did not find really a solution.
>> Do you need any config files to check?
>>
>> Thanks for your help in advance,
>> Timo
>>
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>> child pid [1849690] due to SIGCHLD: exit 255
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>> child pid [1849691] due to SIGCHLD: exit 255
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>> child pid [1849692] due to SIGCHLD: exit 255
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>> child pid [1849693] due to SIGCHLD: exit 255
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>> spawned child process, pid 1849698
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>> child pid [1849696] due to SIGCHLD: exit 255
>> Thu Jun 2 11:43:11 2022 [1849698] error: spamd: cannot run as
>> nonexistent user or root with -u option
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>> spawned child process, pid 1849699
>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SS
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>> spawned child process, pid 1849700
>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
>> children less than 1 minimum idle children. Increasing spamd children:
>> 1849700 started.
>> Thu Jun 2 11:43:11 2022 [1849699] error: spamd: cannot run as
>> nonexistent user or root with -u option
>> Thu Jun 2 11:43:11 2022 [1849700] error: spamd: cannot run as
>> nonexistent user or root with -u option
>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSS
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>> spawned child process, pid 1849701
>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
>> children less than 1 minimum idle children. Increasing spamd children:
>> 1849701 started.
>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSSS
>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>> spawned child process, pid 1849702
>> Thu Jun 2 11:43:11 2022 [1849701] error: spamd: cannot run as
>> nonexistent user or root with -u option
>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
>> children less than 1 minimum idle children. Increasing spamd children:
>> 1849702 started.
>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSSSS

Re: Spamassassin spamming in log [ In reply to ]

bert at ulyssis

Jun 2, 2022, 6:13 AM

Post #4 of 14 (1311 views)

Permalink

For the error: does the spamd user actually exist? that's a requirement
of course.

I've always controlled SA loglevels through amavis, but from the spamd
man page I would expect that it's related to -D. I'm not completely sure
what the default is. http://wiki.apache.org/spamassassin/DebugChannels
is listed for more information.

I expect your high CPU usage is just coming from SA trying to spawn
children as a user that doesn't exist though.

On 2/06/2022 14:57, Timo Brandt wrote:
>
> Hi Bert,
>
> many thanks for your answer.
>
> Please find the spamassassin config below.
>
> I already checked it but do not find anything to change which is
> stopping the flooding.
>
>
> Also, spamassassin is consuming mostly all of my CPU power.
>
> When its running, the CPU is nearly the whole time at 99%. When I stop
> spamassassin, the CPU consumption is going down.
>
>
> # /etc/default/spamassassin
> # Duncan Findlay
>
> # WARNING: please read README.spamd before using.
> # There may be security risks.
>
> # Prior to version 3.4.2-1, spamd could be enabled by setting
> # ENABLED=1 in this file. This is no longer supported. Instead, please
> # use the update-rc.d command, invoked for example as "update-rc.d
> spamassassin enable", to enable the spamd service.
>
> # Options
> # See man spamd for possible options. The -d option is automatically
> added.
> ENABLED=1
> # SpamAssassin uses a preforking model, so be careful! You need to
> # make sure --max-children is not set to anything higher than 5,
> # unless you know what you're doing.
> OPTIONS="--create-prefs --max-children 5 --helper-home-dir --username
> spamd --helper-home-dir /home/spamd -s /var/log/spamassassin/spamd.log
>
> # Pid file
> # Where should spamd write its PID to file? If you use the -u or
> # --username option above, this needs to be writable by that user.
> # Otherwise, the init script will not be able to shut spamd down.
> PIDFILE="/var/run/spamd.pid"
>
> # Set nice level of spamd
> #NICE="--nicelevel 15"
>
> # Cronjob
> # Set to anything but 0 to enable the cron job to automatically update
> # spamassassin's rules on a nightly basis
> CRON=1
>
>
> Am 2022-06-02 14:47, schrieb Bert Van de Poel:
>
>> For the errors about nonexistent uses you will want to have a look at
>> /etc/default/spamassassin I'm guessing.
>> For the info messages: this has just got to do with your logging
>> level. You will want to decrease it in local.cf or maybe also in the
>> default file.
>>
>> On 2/06/2022 14:33, Timo Brandt wrote:
>>> Hi all,
>>>
>>> I have a running debian 11 with postfix/dovecot and Amavis with
>>> clamav / spamassassin.
>>> I saw that the spamassassin logfile is growing very fast and found
>>> the following entries occuring many times per second.
>>> Can you maybe help me to get this fixed?
>>> I searched along the internet but did not find really a solution.
>>> Do you need any config files to check?
>>>
>>> Thanks for your help in advance,
>>> Timo
>>>
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>>> child pid [1849690] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>>> child pid [1849691] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>>> child pid [1849692] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>>> child pid [1849693] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>>> spawned child process, pid 1849698
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>>> child pid [1849696] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1849698] error: spamd: cannot run as
>>> nonexistent user or root with -u option
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>>> spawned child process, pid 1849699
>>> Thu Jun  2 11:43:11 2022 [1848608] info: prefork: child states: SS
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>>> spawned child process, pid 1849700
>>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
>>> children less than 1 minimum idle children. Increasing spamd
>>> children: 1849700 started.
>>> Thu Jun 2 11:43:11 2022 [1849699] error: spamd: cannot run as
>>> nonexistent user or root with -u option
>>> Thu Jun 2 11:43:11 2022 [1849700] error: spamd: cannot run as
>>> nonexistent user or root with -u option
>>> Thu Jun  2 11:43:11 2022 [1848608] info: prefork: child states: SSS
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>>> spawned child process, pid 1849701
>>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
>>> children less than 1 minimum idle children. Increasing spamd
>>> children: 1849701 started.
>>> Thu Jun  2 11:43:11 2022 [1848608] info: prefork: child states: SSSS
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
>>> spawned child process, pid 1849702
>>> Thu Jun 2 11:43:11 2022 [1849701] error: spamd: cannot run as
>>> nonexistent user or root with -u option
>>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
>>> children less than 1 minimum idle children. Increasing spamd
>>> children: 1849702 started.
>>> Thu Jun  2 11:43:11 2022 [1848608] info: prefork: child states: SSSSS
>>>
>>>

Re: Spamassassin spamming in log [ In reply to ]

mail at timo-brandt

Jun 2, 2022, 6:17 AM

Post #5 of 14 (1311 views)

Permalink

Hi Bert,

I checked the user table:

debian-spamd:x:114:120::/var/lib/spamassassin:/usr/sbin/nologin

And also adjusted the config file:

OPTIONS="-u debian-spamd --create-prefs --max-children 5
--helper-home-dir -s /var/log/spamassassin/spamd.log

But process is already running under root:

Am 2022-06-02 15:13, schrieb Bert Van de Poel:

> For the error: does the spamd user actually exist? that's a requirement
> of course.
>
> I've always controlled SA loglevels through amavis, but from the spamd
> man page I would expect that it's related to -D. I'm not completely
> sure what the default is.
> http://wiki.apache.org/spamassassin/DebugChannels is listed for more
> information.
>
> I expect your high CPU usage is just coming from SA trying to spawn
> children as a user that doesn't exist though.
>
> On 2/06/2022 14:57, Timo Brandt wrote:
>
> Hi Bert,
>
> many thanks for your answer.
>
> Please find the spamassassin config below.
>
> I already checked it but do not find anything to change which is
> stopping the flooding.
>
> Also, spamassassin is consuming mostly all of my CPU power.
>
> When its running, the CPU is nearly the whole time at 99%. When I stop
> spamassassin, the CPU consumption is going down.
>
> # /etc/default/spamassassin
> # Duncan Findlay
>
> # WARNING: please read README.spamd before using.
> # There may be security risks.
>
> # Prior to version 3.4.2-1, spamd could be enabled by setting
> # ENABLED=1 in this file. This is no longer supported. Instead, please
> # use the update-rc.d command, invoked for example as "update-rc.d
> spamassassin enable", to enable the spamd service.
>
> # Options
> # See man spamd for possible options. The -d option is automatically
> added.
> ENABLED=1
> # SpamAssassin uses a preforking model, so be careful! You need to
> # make sure --max-children is not set to anything higher than 5,
> # unless you know what you're doing.
> OPTIONS="--create-prefs --max-children 5 --helper-home-dir --username
> spamd --helper-home-dir /home/spamd -s /var/log/spamassassin/spamd.log
>
> # Pid file
> # Where should spamd write its PID to file? If you use the -u or
> # --username option above, this needs to be writable by that user.
> # Otherwise, the init script will not be able to shut spamd down.
> PIDFILE="/var/run/spamd.pid"
>
> # Set nice level of spamd
> #NICE="--nicelevel 15"
>
> # Cronjob
> # Set to anything but 0 to enable the cron job to automatically update
> # spamassassin's rules on a nightly basis
> CRON=1
>
> Am 2022-06-02 14:47, schrieb Bert Van de Poel:
> For the errors about nonexistent uses you will want to have a look at
> /etc/default/spamassassin I'm guessing.
> For the info messages: this has just got to do with your logging level.
> You will want to decrease it in local.cf or maybe also in the default
> file.
>
> On 2/06/2022 14:33, Timo Brandt wrote: Hi all,
>
> I have a running debian 11 with postfix/dovecot and Amavis with clamav
> / spamassassin.
> I saw that the spamassassin logfile is growing very fast and found the
> following entries occuring many times per second.
> Can you maybe help me to get this fixed?
> I searched along the internet but did not find really a solution.
> Do you need any config files to check?
>
> Thanks for your help in advance,
> Timo
>
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849690] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849691] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849692] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849693] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849698
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
> child pid [1849696] due to SIGCHLD: exit 255
> Thu Jun 2 11:43:11 2022 [1849698] error: spamd: cannot run as
> nonexistent user or root with -u option
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849699
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SS
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849700
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
> children less than 1 minimum idle children. Increasing spamd children:
> 1849700 started.
> Thu Jun 2 11:43:11 2022 [1849699] error: spamd: cannot run as
> nonexistent user or root with -u option
> Thu Jun 2 11:43:11 2022 [1849700] error: spamd: cannot run as
> nonexistent user or root with -u option
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSS
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849701
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
> children less than 1 minimum idle children. Increasing spamd children:
> 1849701 started.
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSSS
> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server successfully
> spawned child process, pid 1849702
> Thu Jun 2 11:43:11 2022 [1849701] error: spamd: cannot run as
> nonexistent user or root with -u option
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0 idle
> children less than 1 minimum idle children. Increasing spamd children:
> 1849702 started.
> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: child states: SSSSS

Re: Spamassassin spamming in log [ In reply to ]

bert at ulyssis

Jun 2, 2022, 6:56 AM

Post #6 of 14 (1311 views)

Permalink

Did you restart the unit after changing the configuration? It does seem
like debian-spamd is indeed the correct user. I'm not sure how exactly
the spawning of children works within SA. Has your CPU usage decreased now?

PS: you can just reply to the list, no need to email me personally every
time, that just causes me to get each message twice.

On 2/06/2022 15:17, Timo Brandt wrote:
>
> Hi Bert,
>
>
> I checked the user table:
>
> debian-spamd:x:114:120::/var/lib/spamassassin:/usr/sbin/nologin
>
> And also adjusted the config file:
>
> OPTIONS="-u debian-spamd --create-prefs --max-children 5
> --helper-home-dir -s /var/log/spamassassin/spamd.log
>
>
> But process is already running under root:
>
>
> Am 2022-06-02 15:13, schrieb Bert Van de Poel:
>
>> For the error: does the spamd user actually exist? that's a
>> requirement of course.
>>
>> I've always controlled SA loglevels through amavis, but from the
>> spamd man page I would expect that it's related to -D. I'm not
>> completely sure what the default is.
>> http://wiki.apache.org/spamassassin/DebugChannels
>> <http://wiki.apache.org/spamassassin/DebugChannels> is listed for
>> more information.
>>
>> I expect your high CPU usage is just coming from SA trying to spawn
>> children as a user that doesn't exist though.
>>
>> On 2/06/2022 14:57, Timo Brandt wrote:
>>>
>>> Hi Bert,
>>>
>>> many thanks for your answer.
>>>
>>> Please find the spamassassin config below.
>>>
>>> I already checked it but do not find anything to change which is
>>> stopping the flooding.
>>>
>>>
>>> Also, spamassassin is consuming mostly all of my CPU power.
>>>
>>> When its running, the CPU is nearly the whole time at 99%. When I
>>> stop spamassassin, the CPU consumption is going down.
>>>
>>>
>>> # /etc/default/spamassassin
>>> # Duncan Findlay
>>>
>>> # WARNING: please read README.spamd before using.
>>> # There may be security risks.
>>>
>>> # Prior to version 3.4.2-1, spamd could be enabled by setting
>>> # ENABLED=1 in this file. This is no longer supported. Instead, please
>>> # use the update-rc.d command, invoked for example as "update-rc.d
>>> spamassassin enable", to enable the spamd service.
>>>
>>> # Options
>>> # See man spamd for possible options. The -d option is automatically
>>> added.
>>> ENABLED=1
>>> # SpamAssassin uses a preforking model, so be careful! You need to
>>> # make sure --max-children is not set to anything higher than 5,
>>> # unless you know what you're doing.
>>> OPTIONS="--create-prefs --max-children 5 --helper-home-dir
>>> --username spamd --helper-home-dir /home/spamd -s
>>> /var/log/spamassassin/spamd.log
>>>
>>> # Pid file
>>> # Where should spamd write its PID to file? If you use the -u or
>>> # --username option above, this needs to be writable by that user.
>>> # Otherwise, the init script will not be able to shut spamd down.
>>> PIDFILE="/var/run/spamd.pid"
>>>
>>> # Set nice level of spamd
>>> #NICE="--nicelevel 15"
>>>
>>> # Cronjob
>>> # Set to anything but 0 to enable the cron job to automatically update
>>> # spamassassin's rules on a nightly basis
>>> CRON=1
>>>
>>>
>>> Am 2022-06-02 14:47, schrieb Bert Van de Poel:
>>>
>>> For the errors about nonexistent uses you will want to have a
>>> look at /etc/default/spamassassin I'm guessing.
>>> For the info messages: this has just got to do with your logging
>>> level. You will want to decrease it in local.cf or maybe also in
>>> the default file.
>>>
>>> On 2/06/2022 14:33, Timo Brandt wrote:
>>>
>>> Hi all,
>>>
>>> I have a running debian 11 with postfix/dovecot and Amavis
>>> with clamav / spamassassin.
>>> I saw that the spamassassin logfile is growing very fast and
>>> found the following entries occuring many times per second.
>>> Can you maybe help me to get this fixed?
>>> I searched along the internet but did not find really a solution.
>>> Do you need any config files to check?
>>>
>>> Thanks for your help in advance,
>>> Timo
>>>
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled
>>> cleanup of child pid [1849690] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled
>>> cleanup of child pid [1849691] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled
>>> cleanup of child pid [1849692] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled
>>> cleanup of child pid [1849693] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server
>>> successfully spawned child process, pid 1849698
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled
>>> cleanup of child pid [1849696] due to SIGCHLD: exit 255
>>> Thu Jun 2 11:43:11 2022 [1849698] error: spamd: cannot run
>>> as nonexistent user or root with -u option
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server
>>> successfully spawned child process, pid 1849699
>>> Thu Jun  2 11:43:11 2022 [1848608] info: prefork: child states: SS
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server
>>> successfully spawned child process, pid 1849700
>>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0
>>> idle children less than 1 minimum idle children. Increasing
>>> spamd children: 1849700 started.
>>> Thu Jun 2 11:43:11 2022 [1849699] error: spamd: cannot run
>>> as nonexistent user or root with -u option
>>> Thu Jun 2 11:43:11 2022 [1849700] error: spamd: cannot run
>>> as nonexistent user or root with -u option
>>> Thu Jun  2 11:43:11 2022 [1848608] info: prefork: child states: SSS
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server
>>> successfully spawned child process, pid 1849701
>>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0
>>> idle children less than 1 minimum idle children. Increasing
>>> spamd children: 1849701 started.
>>> Thu Jun  2 11:43:11 2022 [1848608] info: prefork: child states: SSSS
>>> Thu Jun 2 11:43:11 2022 [1848608] info: spamd: server
>>> successfully spawned child process, pid 1849702
>>> Thu Jun 2 11:43:11 2022 [1849701] error: spamd: cannot run
>>> as nonexistent user or root with -u option
>>> Thu Jun 2 11:43:11 2022 [1848608] info: prefork: adjust: 0
>>> idle children less than 1 minimum idle children. Increasing
>>> spamd children: 1849702 started.
>>> Thu Jun  2 11:43:11 2022 [1848608] info: prefork: child states: SSSSS
>>>
>>>

Re: Spamassassin spamming in log [ In reply to ]

me at junc

Jun 2, 2022, 7:20 AM

Post #7 of 14 (1311 views)

Permalink

On 2022-06-02 15:13, Bert Van de Poel wrote:
> For the error: does the spamd user actually exist? that's a
> requirement of course.

to check in shell

id spamd

> I've always controlled SA loglevels through amavis, but from the spamd
> man page I would expect that it's related to -D. I'm not completely
> sure what the default is.

amavisd does not need spamd to be running, but amavisd can still use
spamd user to run as, if that is wanted

> http://wiki.apache.org/spamassassin/DebugChannels is listed for more
> information.

--create-prefs and --username is reqired spamd to be started as root,
also pr user homedir should use $HOME to not create files or logs
outside of home, work around this is to do syslog from spamd with can
create logs safely

> I expect your high CPU usage is just coming from SA trying to spawn
> children as a user that doesn't exist though.

in gentoo with glep 81 spamd user exists

distros without glep 81 have another problems on the same problem

Re: Spamassassin spamming in log [ In reply to ]

me at junc

Jun 2, 2022, 7:25 AM

Post #8 of 14 (1311 views)

Permalink

On 2022-06-02 15:17, Timo Brandt wrote:
> Hi Bert,
>
> I checked the user table:
>
> debian-spamd:x:114:120::/var/lib/spamassassin:/usr/sbin/nologin
>
> And also adjusted the config file:
>
> OPTIONS="-u debian-spamd --create-prefs --max-children 5
> --helper-home-dir -s /var/log/spamassassin/spamd.log

why not syslog for spamd.log ?

-u option is not used in gentoo, but spamd is started as spamd, in
debian it could be started as debian-spamd, so it does not need -u
option ?

> But process is already running under root:

ok or not ?

Re: Spamassassin spamming in log [ In reply to ]

uhlar at fantomas

Jun 2, 2022, 7:53 AM

Post #9 of 14 (1311 views)

Permalink

On 02.06.22 14:33, Timo Brandt wrote:
>I have a running debian 11 with postfix/dovecot and Amavis with clamav
>/ spamassassin.
>I saw that the spamassassin logfile is growing very fast and found the
>following entries occuring many times per second.
>Can you maybe help me to get this fixed?
>I searched along the internet but did not find really a solution.
>Do you need any config files to check?

>Thu Jun 2 11:43:11 2022 [1848608] info: spamd: handled cleanup of
>child pid [1849690] due to SIGCHLD: exit 255

you apparently defined invalid user to run under. I don't specify the user,
so spamd executes checks under different users - I use spamass-milter for
that.

if you use amavis, you don't need spamd.

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Silvester Stallone: Father of the RISC concept.

Re: Spamassassin spamming in log [ In reply to ]

mnalis-sa-list at voyager

Jun 2, 2022, 11:18 AM

Post #10 of 14 (1311 views)

Permalink

On Thu, Jun 02, 2022 at 02:47:28PM +0200, Bert Van de Poel wrote:
> For the errors about nonexistent uses you will want to have a look at
> /etc/default/spamassassin I'm guessing.
> For the info messages: this has just got to do with your logging level. You
> will want to decrease it in local.cf or maybe also in the default file.

Also, depending on your distro and init system, /etc/default/spamassassin
might not be processed (e.g. on Debian systems, in many cases /etc/default/*
entries are only read via /etc/init.d/* System-V-init scripts, and
not used when using default systemd init system).

You should use "ps auxwwwww" to determine with what exactly
parameters it is being run, and then grep the system for those flags
if different from ones in /etc/default/spamassassin (esp. when you
change that file and restart, but changes are not applied)

--
Opinions above are GNU-copylefted.

Re: Spamassassin spamming in log [ In reply to ]

mail at timo-brandt

Jun 2, 2022, 11:27 AM

Post #11 of 14 (1311 views)

Permalink

Hi all,

indeed - sorry.

I wasnt aware of that I do not need to run spamd beside amavis ????

Thanks for all your help.

Timo

Am 2022-06-02 20:18, schrieb Matija Nalis:

> On Thu, Jun 02, 2022 at 02:47:28PM +0200, Bert Van de Poel wrote:
>
>> For the errors about nonexistent uses you will want to have a look at
>> /etc/default/spamassassin I'm guessing.
>> For the info messages: this has just got to do with your logging
>> level. You
>> will want to decrease it in local.cf or maybe also in the default
>> file.
>
> Also, depending on your distro and init system,
> /etc/default/spamassassin
> might not be processed (e.g. on Debian systems, in many cases
> /etc/default/*
> entries are only read via /etc/init.d/* System-V-init scripts, and
> not used when using default systemd init system).
>
> You should use "ps auxwwwww" to determine with what exactly
> parameters it is being run, and then grep the system for those flags
> if different from ones in /etc/default/spamassassin (esp. when you
> change that file and restart, but changes are not applied)

Re: Spamassassin spamming in log [ In reply to ]

mail at timo-brandt

Jun 2, 2022, 11:36 AM

Post #12 of 14 (1311 views)

Permalink

Maybe one of you has a hint for me how to disable the automatic startup
of spamd?

Its been a long time ago that I setup a Debian from scratch :-(

It seems that spamd doesnt need to start at system boot so I will
disable it.

Will this be done when I add ENABLED=0 into the file
/etc/default/spamassassin ?

Thanks,

Timo

Am 2022-06-02 20:27, schrieb Timo Brandt:

> Hi all,
>
> indeed - sorry.
>
> I wasnt aware of that I do not need to run spamd beside amavis ????
>
> Thanks for all your help.
>
> Timo
>
> Am 2022-06-02 20:18, schrieb Matija Nalis:
> On Thu, Jun 02, 2022 at 02:47:28PM +0200, Bert Van de Poel wrote: For
> the errors about nonexistent uses you will want to have a look at
> /etc/default/spamassassin I'm guessing.
> For the info messages: this has just got to do with your logging level.
> You
> will want to decrease it in local.cf or maybe also in the default file.
> Also, depending on your distro and init system,
> /etc/default/spamassassin
> might not be processed (e.g. on Debian systems, in many cases
> /etc/default/*
> entries are only read via /etc/init.d/* System-V-init scripts, and
> not used when using default systemd init system).
>
> You should use "ps auxwwwww" to determine with what exactly
> parameters it is being run, and then grep the system for those flags
> if different from ones in /etc/default/spamassassin (esp. when you
> change that file and restart, but changes are not applied)

Re: Spamassassin spamming in log [ In reply to ]

bert at ulyssis

Jun 2, 2022, 11:49 AM

Post #13 of 14 (1311 views)

Permalink

If you are using systemd, you can "systemctl disable spamd". Otherwise
you can indeed use the enabled=0. I would probably do both just in case ;)

On 2/06/2022 20:36, Timo Brandt wrote:
>
> Maybe one of you has a hint for me how to disable the automatic
> startup of spamd?
>
> Its been a long time ago that I setup a Debian from scratch :-(
>
> It seems that spamd doesnt need to start at system boot so I will
> disable it.
>
>
> Will this be done when I add ENABLED=0 into the file
> /etc/default/spamassassin ?
>
>
>
> Thanks,
>
> Timo
>
>
> Am 2022-06-02 20:27, schrieb Timo Brandt:
>
>> Hi all,
>>
>>
>> indeed - sorry.
>>
>> I wasnt aware of that I do not need to run spamd beside amavis ????
>>
>> Thanks for all your help.
>>
>> Timo
>>
>>
>> Am 2022-06-02 20:18, schrieb Matija Nalis:
>>
>> On Thu, Jun 02, 2022 at 02:47:28PM +0200, Bert Van de Poel wrote:
>>
>> For the errors about nonexistent uses you will want to have a
>> look at
>> /etc/default/spamassassin I'm guessing.
>> For the info messages: this has just got to do with your
>> logging level. You
>> will want to decrease it in local.cf or maybe also in the
>> default file.
>>
>>
>> Also, depending on your distro and init system,
>> /etc/default/spamassassin
>> might not be processed (e.g. on Debian systems, in many cases
>> /etc/default/*
>> entries are only read via /etc/init.d/* System-V-init scripts, and
>> not used when using default systemd init system).
>>
>> You should use "ps auxwwwww" to determine with what exactly
>> parameters it is being run, and then grep the system for those flags
>> if different from ones in /etc/default/spamassassin (esp. when you
>> change that file and restart, but changes are not applied)
>>

Re: Spamassassin spamming in log [ In reply to ]

mail at timo-brandt

Jun 2, 2022, 1:09 PM

Post #14 of 14 (1311 views)

Permalink

Thanks, Bert :-)

Am 2022-06-02 20:49, schrieb Bert Van de Poel:

> If you are using systemd, you can "systemctl disable spamd". Otherwise
> you can indeed use the enabled=0. I would probably do both just in case
> ;)
>
> On 2/06/2022 20:36, Timo Brandt wrote:
>
> Maybe one of you has a hint for me how to disable the automatic startup
> of spamd?
>
> Its been a long time ago that I setup a Debian from scratch :-(
>
> It seems that spamd doesnt need to start at system boot so I will
> disable it.
>
> Will this be done when I add ENABLED=0 into the file
> /etc/default/spamassassin ?
>
> Thanks,
>
> Timo
>
> Am 2022-06-02 20:27, schrieb Timo Brandt:
>
> Hi all,
>
> indeed - sorry.
>
> I wasnt aware of that I do not need to run spamd beside amavis ????
>
> Thanks for all your help.
>
> Timo
>
> Am 2022-06-02 20:18, schrieb Matija Nalis:
> On Thu, Jun 02, 2022 at 02:47:28PM +0200, Bert Van de Poel wrote: For
> the errors about nonexistent uses you will want to have a look at
> /etc/default/spamassassin I'm guessing.
> For the info messages: this has just got to do with your logging level.
> You
> will want to decrease it in local.cf or maybe also in the default file.
> Also, depending on your distro and init system,
> /etc/default/spamassassin
> might not be processed (e.g. on Debian systems, in many cases
> /etc/default/*
> entries are only read via /etc/init.d/* System-V-init scripts, and
> not used when using default systemd init system).
>
> You should use "ps auxwwwww" to determine with what exactly
> parameters it is being run, and then grep the system for those flags
> if different from ones in /etc/default/spamassassin (esp. when you
> change that file and restart, but changes are not applied)

Mailing List Archive

Attached Files:

Attached Files: