Hi All,

I'm a newbie to linux mail server.
Currently I'm using Slackware 10 and sendmail 8.13.2 in my office.
Recently, I notice that the spamd is not working and I try to start it, the spamd starts and later it stops again.

No mails are filtered by spamd.

And currently I have faced slow connection with the mail server. The mail has to be stuck in the outbox for awhile then can be sent out.

Anyone expert here please assist me on the above problem.

Thanks.

That's not a lot to go on. Have you set up your procmairc to send mail through Spamassassin?

Hi,

How do i check on that ?
The system setup by a vendor last time and no documentation about it.
Now my turn to support it, i really do not have any idea.

I am not sure about your release but on mine (RHEL3) it goes like this

1 ) make sure spamassassin is running
[root@lift01 temp]# service spamassassin status
spamd (pid 25564 24257 2445) is running...

2 ) check procmailrc in /etc mine looks something like this

# send mail through spamassassin
SHELL=/bin/sh
PMDIR=/etc/Procmail
LOGFILE=$PMDIR/pmlog
MAILDIR=$HOME/mail

:0fw
| /usr/bin/spamc

:0:
* ^Subject:.*SPAM
Spam

#EOF


I use Linux as a PDC , spam is automatically put in a user subfolder called SPAM using the above script for anything with a score > 7.5

You can try to debug spamassassin, running:

Hi bathory,

I have run the command and below is the result.

root@infra:/etc# spamassassin -D --lint
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/usr/games', keeping.
debug: PATH included '/opt/www/htdig/bin', keeping.
debug: PATH included '/usr/lib/java/bin', keeping.
debug: PATH included '/usr/lib/java/jre/bin', keeping.
debug: PATH included '/opt/kde/bin', keeping.
debug: PATH included '/usr/lib/qt/bin', keeping.
debug: PATH included '/usr/share/texmf/bin', keeping.
debug: Final PATH set to: /usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bi n:/bin:/usr/X11R6/bin:/usr/games:/opt/www/htdig/bin:/usr/lib/java/bin:/usr/lib/j ava/jre/bin:/opt/kde/bin:/usr/lib/qt/bin:/usr/share/texmf/bin
debug: ignore: using a test message to lint rules
debug: using "/usr/share/spamassassin" for default rules dir
debug: using "/etc/mail/spamassassin" for site rules dir
debug: using "/root/.spamassassin" for user state dir
debug: using "/root/.spamassassin" for user state dir
Created user preferences file: /root/.spamassassin/user_prefs
debug: using "/root/.spamassassin/user_prefs" for user prefs file
debug: using "/root/.spamassassin" for user state dir
debug: bayes: no dbs present, cannot scan: /root/.spamassassin/bayes_toks
debug: Score set 1 chosen.
debug: Initialising learner
debug: bayes: Not available for scanning, only 0 spam(s) in Bayes DB < 200
debug: bayes: 17323 untie-ing
debug: bayes: 17323 untie-ing db_toks
debug: is Net:NS::Resolver available? no
debug: is DNS available? 0
debug: running header regexp tests; score so far=0
debug: running body-text per-line regexp tests; score so far=1.27
debug: Razor2 is not available
debug: running raw-body-text per-line regexp tests; score so far=1.27
debug: running uri tests; score so far=1.27
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=1.27
debug: Razor2 is not available
debug: Current PATH is: /usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin: /bin:/usr/X11R6/bin:/usr/games:/opt/www/htdig/bin:/usr/lib/java/bin:/usr/lib/jav a/jre/bin:/opt/kde/bin:/usr/lib/qt/bin:/usr/share/texmf/bin
debug: Pyzor is not available: pyzor not found
debug: DCCifd is not available: no r/w dccifd socket found.
debug: DCC is not available: no executable dccproc found.
debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
debug: all '*To' addrs:
debug: running meta tests; score so far=1.27
debug: is spam? score=1.27 required=5 tests=DATE_MISSING,NO_REAL_NAME

anyway I'm not understand result of the debug??!!

It looks normal even though you miss some modules.
Take a look at your logs (probably mail.log or maillog) to see if you find something about the problem. You can also run spamd in debug mode, using the "-D" option, to have more things logged.

Hi Bathory,

when I run the spamd -D, bellow are the result:

debug: Score set 0 chosen.
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/usr/games', keeping.
debug: PATH included '/opt/www/htdig/bin', keeping.
debug: PATH included '/usr/lib/java/bin', keeping.
debug: PATH included '/usr/lib/java/jre/bin', keeping.
debug: PATH included '/opt/kde/bin', keeping.
debug: PATH included '/usr/lib/qt/bin', keeping.
debug: PATH included '/usr/share/texmf/bin', keeping.
debug: Final PATH set to: /usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/usr/X11R6/bin:/usr/games:/opt/www/htdig/bin:/usr/lib/java/bin:/usr/lib/java/jre/bin:/opt/kde/bin:/usr/lib/qt/bin:/usr/share/texmf/bin

Could not create INET socket: Address already in use IO::Socket::INET: Address already in use

when I run netstat -lpm, bellow are the results

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:37 0.0.0.0:* LISTEN 868/inetd
tcp 0 0 127.0.0.1:10024 0.0.0.0:* LISTEN 9890/amavisd (maste
tcp 0 0 127.0.0.1:10025 0.0.0.0:* LISTEN 9899/sendmail: acce
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 945/mysqld
tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN 9896/sendmail: acce
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 957/smbd
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 868/inetd
tcp 0 0 127.0.0.1:783 0.0.0.0:* LISTEN 5934/spamd -d
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 868/inetd

It looks like spamd is running and listening to port 783.
But I do not see any spamd in the maillog??!!

That's normal since spamd was running. What I told you is to start spamd using -D among the other startup options.

From the output of netstat I see that you're running amavisd. When you run amavisd as a spam/virus filter there is no need for spamd to run. Whenever a mail arrives it's amavisd that uses spamassassin to score the mail and decide if it's spam or not. So you better stop spamd from running and make sure it's not configured to run at system startup. Then restart amavisd (you can also use the debug option for it) and watch the amavisd logs if you suspect that it's not working as expected.

Regards

Hi Bathory,

Thanks for the information. Now I understand why my spamd is not running.Actually amavisd is doing the filtering job.

Recently I notice my smtp is slow for sending out mail messages and I have the following message when I restart sendmail service.

LibClamAv Error: hex2int() translation problem(40)
LibClamAv Error: readdb(): Malformed pattern line 30284 (file /tmp/clamav-ea3e7e6c8dbe5d3f/main.db)

Does it mean something wrong with my clamd or amavisd?

So you should stop spamd from running and make sure it's not starting on system boot.
As for clamav, I think you should upgrade clamav to the latest version (0.91.2) to see if it solves your problem.

Regards

The spamd is stopped and I try to find the tmp/clamav-ea3e7e6c8dbe5d3f/main.db, but unable to find it.

i'm not sure after upgrade , the amavisd still working or not or anything happens after upgrade.

Anyway I will find the document and try upgrade it.

You can find your current clamd version running:

The command does not work on my system.....error show and nothing show in result.

Perhaps clamd is not in your PATH. You can use the whole path to it to run the command:
If you upgrade clamav successfully amavisd will work without any problems since it connects with clamd to scan for virusses through a socket (usually /tmp/clamd).
Mind that /tmp/clamd and /tmp/clamav-ea3e7e6c8dbe5d3f/main.db are 2 different things. The first one is the socket used by other programs to connect to clamd and the second is a temporary file created more likely during clamav virus definition updates.