Topic: possible looping problem with spam assassin (Swerts-Knudsen)

[cmwi96]

I am using the Swerts-Knudsen install scripts for both ClamAV and SpamAssassin. I recently upgraded from older versions. When I enable Spam filtering from the panel my system becomes slow or even unresponsive. top show MANY instances of Perl5.6.1 running by the user qmailq. Left unchecked this will eventually consume all the memory resources of the machine. If I switch off the Spam filter the available memory returns to normal levels. Additionally a message sent while the filter was on but finally delivered after it was turned off contained the following :
Received: (qmail 4832 invoked by alias); 18 May 2005 15:34:27 -0000
Delivered-To: alias-localdelivery-edit@watkinsbros.net
Received: (qmail 4829 invoked from network); 18 May 2005 15:34:26 -0000
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
Received: from localhost (127.0.0.1)
  by box2.watkinsbros.net (127.0.0.1) with ESMTP; 18 May 2005 15:31:11 -0000
 
This leads me to believe that the mail is being run through this process several times. A test message sent while the Spam filter was off yealds the expected:
Received: (qmail 5211 invoked by alias); 18 May 2005 15:38:08 -0000
Delivered-To: alias-localdelivery-edit@watkinsbros.net
Received: (qmail 5208 invoked from network); 18 May 2005 15:38:08 -0000
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on box2.watkinsbros.net
Received: from localhost (127.0.0.1)

Can anyone give me any suggestions?

[nate]

I am experiencing the same kind of thing.  
Admin account filling up with double bounce messages
and looping galore!  

I’m not going to be too quick to place blame however;
this could be bad DNS MX, (no reverse or duplicates)
or other bad config.
 
The only data point I know for sure is the thing runs like a pig
with Spamassassin turned on and just fine with it off.
 
(Ver. 6.0.1 w/smeplus)

[Knuddi]

Are you guys using the fetchmail contrib or ezl(something)?

[nate]

Are you guys using the fetchmail contrib or ezl(something)?

 
This is the one:http://sme.swerts-knudsen.com/howtos/howto_29.htm
unless it's been updated?
 
smeplus.sh - all extras installed with no errors about a month ago.

[cmwi96]

I don't remember insalling fetchmail but it may have been part of another package. (was it ever part of the original clamAV or SA package?). in any case
 rpm -qa |grep fetch
fetchmail-5.9.0-21.7.3

I couldn't say what its doing though.

[cmwi96]

did you by any chance mean exmlm?
ezmlm-idx-std-0.40-2
ezmlm-web-2.1-06
e-smith-ezmlm-web-1.1.1-05

[Knuddi]

Yes this is the one - I just recall a problem in the past with the combination of SA (amavis) and ezlm. Cannot recall that it looped by that it at least something was wrong. Try a search in the forum and maybe someone else can remember ??

[cmwi96]

I did find a post that says the combination of these causes the Spam filter to stop working, though there was no mention of the kind of processes or memory problems. Also I had been using your scripts on th same install with no issues until I installed the spamfilter_install.sh this morning. I had never experienced a problem having both.

[cmwi96]

another bit of info the Perl process that seems to open in several intsances seems to itterations of the /usr/bin/suidperl -w command if this helps. I did some looking and it seems as if a problem with this could cause messages to be scanned multiple times (which is what this seems like). Thoughts?

[raem]

Check your qmail-queue settings, these are with Jespers antivirus & spam filter panels installed.

# /sbin/e-smith/db configuration show smtpfront-qmail
smtpfront-qmail=service
    ExternalInterfacesFilter=/usr/bin/qmail-queue.amavis
    Instances=40
    InternalInterfacesFilter=/usr/bin/qmail-queue.amavis
    Patterns=enabled
    PatternsFile=/var/qmail/control/patterns.default
    Proxy=enabled
    RBLList=whois.rfc-ignorant.org:dnsbl.sorbs.net:relays.ordb.org:sbl-xbl.spamhaus.org
    access=public
    status=enabled

# /sbin/e-smith/db configuration show amavis-ng
amavis-ng=service
    MailFrom=antivirus@xxxxxxx.xxx.xxx
    Notifiers=Admin
    qmail-queue=/var/qmail/bin/qmail-spamc
    status=enabled

if necessary either correct the entries manually or
maybe run the install script(s) again so "things" get configured correctly ?

[cmwi96]

All of these properties read as they should with  the exception of the qmail-queue property which reads /var/qmail/bin/qmail-queue. I believe this is because I currently have SpamAssassin disabled in order to keep the box from crashing. I do believe enableing SA from the pannel changes this property however I have tried changing it manually and it just causes SA to start working but not correctly as I still have the original issue.

[cmwi96]

New info:
I unintalled all the ezMLM RPMs and ran a post-upgrade event and rebooted. While there is no EZMLM now I still have the same SA issue.
Also in the running processes during the "hang-up" I see quite a bit of this.
qmailq    3263  3260  5 09:29 ?        00:00:01 /usr/bin/suidperl -w /dev/fd/4//
qmailq    3264  3263  0 09:29 ?        00:00:00 [spamc <defunct>]
qmailq    3268  3263  7 09:29 ?        00:00:01 /usr/bin/suidperl -w /dev/fd/5//
qmailq    3269  3268  0 09:29 ?        00:00:00 [spamc <defunct>]
qmailq    3271  3268  9 09:29 ?        00:00:01 /usr/bin/suidperl -w /dev/fd/6//
qmailq    3272  3271  0 09:29 ?        00:00:00 [spamc <defunct>]
qmailq    3274  3271 14 09:29 ?        00:00:01 /usr/bin/suidperl -w /dev/fd/7//
qmailq    3275  3274  0 09:29 ?        00:00:00 [spamc <defunct>]
qmailq    3277  3274 23 09:30 ?        00:00:01 /usr/bin/suidperl -w /dev/fd/8//
qmailq    3278  3277  0 09:30 ?        00:00:00 [spamc <defunct>]

as I said lots of perl instances.

is anyone else having this issue?

[ltc6netspec]

Are you running messagewall?  If so I had to force a reinstall of it.  It ran for 10 minutes until I reinstalled the profiles I have used for a year.  Then it went back to your problem.  I just uninstalled messagewall to see if the perl problem would go away.  it did not.  Where is the file for spamassassin RBLs and to make sure spamassassin is not enabled.  

Configuration:  removed New spamassassin/ reinstalled old spamassassin still same problem.  Installed new clamav still same problem

HELP - 900 users

[cmwi96]

I'm not running messagewall.

[ltc6netspec]

Should perl be reinstalled?