MCP-Checker (MCP timed out) - More details of the cause
Quentin Campbell
Q.G.Campbell at newcastle.ac.uk
Fri Jun 2 14:39:22 IST 2006
The delay in 'spamassassin' for the particular site is apparently caused
while SA tries to do a DNS PTR lookup for the IP addresses in the
'Received:" lines. It seems that the NS for the site is very slow to
respond:
...
[19506] dbg: dns: looking up PTR record for '165.198.2.156'
[19506] dbg: dns: PTR for '165.198.2.156': ''
[19506] dbg: received-header: parsed as [ ip=165.198.2.156 rdns=
helo=pepwmr00040.cww.pep.pvt by=pepwmz00096.pbsg.com ident= envfrom=
intl=0 id= auth= ]
[19506] dbg: received-header: relay 165.198.2.156 trusted? no internal?
no
[19506] dbg: dns: looking up PTR record for '165.198.2.160'
[19506] dbg: dns: PTR for '165.198.2.160': ''
[19506] dbg: received-header: parsed as [ ip=165.198.2.160 rdns=
helo=pepwmr00029.cww.pep.pvt by=pepwmr00040.cww.pep.pvt ident= envfrom=
intl=0 id= auth= ]
[19506] dbg: received-header: relay 165.198.2.160 trusted? no internal?
no
[19506] dbg: dns: looking up PTR record for '165.198.22.184'
[19506] dbg: dns: PTR for '165.198.22.184': ''
[19506] dbg: received-header: parsed as [ ip=165.198.22.184 rdns=
helo=pepwmu00265.cww.pep.pvt by=pepwmr00029.cww.pep.pvt ident= envfrom=
intl=0 id= auth= ]
[19506] dbg: received-header: relay 165.198.22.184 trusted? no internal?
no
[19506] dbg: dns: looking up PTR record for '165.198.218.84'
[19506] dbg: dns: PTR for '165.198.218.84': ''
[19506] dbg: received-header: parsed as [ ip=165.198.218.84 rdns=
helo=pepwmu00262.cww.pep.pvt by=pepwmu00265.cww.pep.pvt ident= envfrom=
intl=0 id= auth= ]
[19506] dbg: received-header: relay 165.198.218.84 trusted? no internal?
no
...
However it is not clear why this slows down the invocation of SA for MCP
checks since the 'Received:' header lines should not be part of what is
scanned at that point.
Quentin
---
PHONE: +44 191 222 8209 Information Systems and Services (ISS),
University of Newcastle,
Newcastle upon Tyne,
FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
------------------------------------------------------------------------
Any opinion expressed above is mine and not that of Newcastle
University.
>-----Original Message-----
>From: mailscanner-bounces at lists.mailscanner.info
>[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>Of Quentin Campbell
>Sent: 02 June 2006 14:22
>To: MailScanner discussion
>Subject: RE: MCP-Checker (MCP timed out) - Answer: MCP
>spamassassin timingout
>
>Have identified the cause and found a work around but am worried that a
>simple message could give rise to this problem.
>
>Am getting the MCP checker "timed out" message because the
>invocation of
>'spamassassin' that is run for MCP processing is timing out for the
>messages in question. It will do this even if I have an _empty_ 'mcp'
>subdirectory!
>
>I note from MailScanner.conf in 4.51.6-1 that the timeout
>values for the
>MCP and non-MCP invocations of 'spamassassin' are different. For the
>former it is only 10 seconds while for the latter it is 75
>seconds! That
>explains why I only see the probem when the MCP check is done. The
>default values set by Julian are:
>
>SpamAssassin Timeout = 75
>MCP SpamAssassin Timeout = 10
>
>The work around was to change in MailScanner.conf the 'MCP SpamAssassin
>Timeout' value from 10 to 75 (seconds).
>
>Quentin
>---
>PHONE: +44 191 222 8209 Information Systems and Services (ISS),
> University of Newcastle,
> Newcastle upon Tyne,
>FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>---------------------------------------------------------------
>---------
>Any opinion expressed above is mine and not that of Newcastle
>University.
>
>
>>-----Original Message-----
>>From: mailscanner-bounces at lists.mailscanner.info
>>[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>>Of Quentin Campbell
>>Sent: 02 June 2006 08:54
>>To: MailScanner discussion
>>Subject: RE: MCP-Checker (MCP timed out) - what is happening?
>>
>>Jeremy
>>
>>Have run 'spamassassin --siteconfigpath=/etc/MailScanner/mcp
>>--lint' and
>>this shows no problems. In my case I have more than one *.cf file in
>>~/mcp.
>>
>>I have found 59 instances of this problem occurring over the last 8
>>weeks. That is a tiny number compared to the 1,000,000 or so
>>messages we
>>receive per day so the problem seems to arise out of a very
>special set
>>of circumstances.
>>
>>Not just mail from 'intl.pepsico.com' is involved although that site
>>accounts for a significant proportion of the 59 cases. At least two
>>different people sending mail from that site have beem affected.
>>
>>A full extract of log records for one such instance is:
>>
>>Jun 1 10:12:26 cheviot2 sendmail[25995]: k519CLJN025995:
>>from=<xxx.yyy at intl.pepsico.com>, size=2953, class=0, nrcpts=1,
>>msgid=<933D22EF8B0CA249BC3C5056C06FCE2201FCBB9D at pepwmu00262.cww
>>.pep.pvt>
>>, proto=ESMTP, daemon=MTA, relay=pepwmz00096.pbsg.com [195.33.104.10]
>>
>>Jun 1 10:12:26 cheviot2 sendmail[25995]: k519CLJN025995: Milter add:
>>header: Received-SPF: none (cheviot2.ncl.ac.uk: domain of
>>xxx.yyy at intl.pepsico.com does not designate permitted sender hosts)
>>
>>Jun 1 10:12:26 cheviot2 sendmail[25995]: k519CLJN025995:
>>to=<aaa.bbb at newcastle.ac.uk>, delay=00:00:00, mailer=esmtp, pri=32953,
>>stat=queued
>>
>>Jun 1 10:12:39 cheviot2 MailScanner[22318]: Message
>>k519CLJN025995 from
>>195.33.104.10 (xxx.yyy at intl.pepsico.com) to newcastle.ac.uk is MCP,
>>MCP-Checker (MCP timed out)
>>
>>Jun 1 10:12:39 cheviot2 MailScanner[22318]: MCP Actions: message
>>k519CLJN025995 actions are deliver
>>
>>At this point the message disappears from the queue. It is not
>>delivered
>>and the log records above confirm this.
>>
>>I am running with MailScanner-4.51.6-1 and SpamAssassin 3.1.1.
>>
>>Quentin
>>---
>>PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>> University of Newcastle,
>> Newcastle upon Tyne,
>>FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>---------------------------------------------------------------
>>---------
>>Any opinion expressed above is mine and not that of Newcastle
>>University.
>>
>>
>>>-----Original Message-----
>>>From: mailscanner-bounces at lists.mailscanner.info
>>>[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>>>Of Jeremy Blonde
>>>Sent: 01 June 2006 17:08
>>>To: MailScanner discussion
>>>Subject: RE: MCP-Checker (MCP timed out) - what is ahppening?
>>>
>>>I ran into this same problem. I had to delete my existing mcp
>>>rule file
>>>and re-create it. Apparently, I had added a typo somewhere.
>>>
>>>
>>>Jeremy Blonde
>>>Instructional Technology - Server Support
>>>Grant Joint Union School District
>>>
>>>
>>>-----Original Message-----
>>>From: mailscanner-bounces at lists.mailscanner.info
>>>[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>>>Of Quentin
>>>Campbell
>>>Sent: Thursday, June 01, 2006 9:00 AM
>>>To: mailscanner at lists.mailscanner.info
>>>Subject: MCP-Checker (MCP timed out) - what is ahppening?
>>>
>>>I am seeing for one sender the following record in the logs:
>>>
>>>Jun 1 10:13:57 cheviot1 MailScanner[425]: Message
>k519DcIG001362 from
>>>195.33.10 4.10 (xxx.yyy at intl.pepsico.com) to newcastle.ac.uk is MCP,
>>>MCP-Checker (MCP timed out)
>>>
>>>The mail is disappearing. What might be the cause?
>>>
>>>Quentin
>>>---
>>>PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>>> University of Newcastle,
>>> Newcastle upon Tyne,
>>>FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>>---------------------------------------------------------------
>>>---------
>>>Any opinion expressed above is mine and not that of Newcastle
>>>University.
>>>--
>>>MailScanner mailing list
>>>mailscanner at lists.mailscanner.info
>>>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>>Before posting, read http://wiki.mailscanner.info/posting
>>>
>>>Support MailScanner development - buy the book off the website!
>>>--
>>>MailScanner mailing list
>>>mailscanner at lists.mailscanner.info
>>>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>>Before posting, read http://wiki.mailscanner.info/posting
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>--
>>MailScanner mailing list
>>mailscanner at lists.mailscanner.info
>>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>>Before posting, read http://wiki.mailscanner.info/posting
>>
>>Support MailScanner development - buy the book off the website!
>>
>--
>MailScanner mailing list
>mailscanner at lists.mailscanner.info
>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>Before posting, read http://wiki.mailscanner.info/posting
>
>Support MailScanner development - buy the book off the website!
>
More information about the MailScanner
mailing list