MCP-Checker (MCP timed out) - More details of the cause
Julian Field
MailScanner at ecs.soton.ac.uk
Fri Jun 2 16:45:34 IST 2006
Should I therefore increase the default MCP timeout to 75 seconds?
On 2 Jun 2006, at 15:55, Quentin Campbell wrote:
> Re. my message below the output I provided is a result of running
> 'spamassassin -t ...' on a sample message which includes the Received:
> headers. When they are removed then 'spamassassin' runs very quickly.
>
> The inference that I draw from this is that when the message is being
> run through the production MailScanner set up here, some DNS checks
> are
> being carried out during MCP processing. The DNS delays are most
> likely
> being caused by the same IP addresses that appear in the Received:
> headers. Unlikely I know but it is the only explanation I can find.
>
> Quentin
> ---
> PHONE: +44 191 222 8209 Information Systems and Services (ISS),
> University of Newcastle,
> Newcastle upon Tyne,
> FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
> ----------------------------------------------------------------------
> --
> Any opinion expressed above is mine and not that of Newcastle
> University.
>
>
>> -----Original Message-----
>> From: mailscanner-bounces at lists.mailscanner.info
>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>> Of Quentin Campbell
>> Sent: 02 June 2006 14:39
>> To: MailScanner discussion
>> Subject: RE: MCP-Checker (MCP timed out) - More details of the cause
>>
>> The delay in 'spamassassin' for the particular site is
>> apparently caused
>> while SA tries to do a DNS PTR lookup for the IP addresses in the
>> 'Received:" lines. It seems that the NS for the site is very slow to
>> respond:
>>
>> ...
>> [19506] dbg: dns: looking up PTR record for '165.198.2.156'
>> [19506] dbg: dns: PTR for '165.198.2.156': ''
>> [19506] dbg: received-header: parsed as [ ip=165.198.2.156 rdns=
>> helo=pepwmr00040.cww.pep.pvt by=pepwmz00096.pbsg.com ident= envfrom=
>> intl=0 id= auth= ]
>> [19506] dbg: received-header: relay 165.198.2.156 trusted? no
>> internal?
>> no
>> [19506] dbg: dns: looking up PTR record for '165.198.2.160'
>> [19506] dbg: dns: PTR for '165.198.2.160': ''
>> [19506] dbg: received-header: parsed as [ ip=165.198.2.160 rdns=
>> helo=pepwmr00029.cww.pep.pvt by=pepwmr00040.cww.pep.pvt ident=
>> envfrom=
>> intl=0 id= auth= ]
>> [19506] dbg: received-header: relay 165.198.2.160 trusted? no
>> internal?
>> no
>> [19506] dbg: dns: looking up PTR record for '165.198.22.184'
>> [19506] dbg: dns: PTR for '165.198.22.184': ''
>> [19506] dbg: received-header: parsed as [ ip=165.198.22.184 rdns=
>> helo=pepwmu00265.cww.pep.pvt by=pepwmr00029.cww.pep.pvt ident=
>> envfrom=
>> intl=0 id= auth= ]
>> [19506] dbg: received-header: relay 165.198.22.184 trusted? no
>> internal?
>> no
>> [19506] dbg: dns: looking up PTR record for '165.198.218.84'
>> [19506] dbg: dns: PTR for '165.198.218.84': ''
>> [19506] dbg: received-header: parsed as [ ip=165.198.218.84 rdns=
>> helo=pepwmu00262.cww.pep.pvt by=pepwmu00265.cww.pep.pvt ident=
>> envfrom=
>> intl=0 id= auth= ]
>> [19506] dbg: received-header: relay 165.198.218.84 trusted? no
>> internal?
>> no
>> ...
>>
>> However it is not clear why this slows down the invocation of
>> SA for MCP
>> checks since the 'Received:' header lines should not be part of
>> what is
>> scanned at that point.
>>
>> Quentin
>> ---
>> PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>> University of Newcastle,
>> Newcastle upon Tyne,
>> FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>> ---------------------------------------------------------------
>> ---------
>> Any opinion expressed above is mine and not that of Newcastle
>> University.
>>
>>
>>> -----Original Message-----
>>> From: mailscanner-bounces at lists.mailscanner.info
>>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>>> Of Quentin Campbell
>>> Sent: 02 June 2006 14:22
>>> To: MailScanner discussion
>>> Subject: RE: MCP-Checker (MCP timed out) - Answer: MCP
>>> spamassassin timingout
>>>
>>> Have identified the cause and found a work around but am
>> worried that a
>>> simple message could give rise to this problem.
>>>
>>> Am getting the MCP checker "timed out" message because the
>>> invocation of
>>> 'spamassassin' that is run for MCP processing is timing out for the
>>> messages in question. It will do this even if I have an _empty_
>>> 'mcp'
>>> subdirectory!
>>>
>>> I note from MailScanner.conf in 4.51.6-1 that the timeout
>>> values for the
>>> MCP and non-MCP invocations of 'spamassassin' are different. For the
>>> former it is only 10 seconds while for the latter it is 75
>>> seconds! That
>>> explains why I only see the probem when the MCP check is done. The
>>> default values set by Julian are:
>>>
>>> SpamAssassin Timeout = 75
>>> MCP SpamAssassin Timeout = 10
>>>
>>> The work around was to change in MailScanner.conf the 'MCP
>> SpamAssassin
>>> Timeout' value from 10 to 75 (seconds).
>>>
>>> Quentin
>>> ---
>>> PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>>> University of Newcastle,
>>> Newcastle upon Tyne,
>>> FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>> ---------------------------------------------------------------
>>> ---------
>>> Any opinion expressed above is mine and not that of Newcastle
>>> University.
>>>
>>>
>>>> -----Original Message-----
>>>> From: mailscanner-bounces at lists.mailscanner.info
>>>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>>>> Of Quentin Campbell
>>>> Sent: 02 June 2006 08:54
>>>> To: MailScanner discussion
>>>> Subject: RE: MCP-Checker (MCP timed out) - what is happening?
>>>>
>>>> Jeremy
>>>>
>>>> Have run 'spamassassin --siteconfigpath=/etc/MailScanner/mcp
>>>> --lint' and
>>>> this shows no problems. In my case I have more than one *.cf
>>>> file in
>>>> ~/mcp.
>>>>
>>>> I have found 59 instances of this problem occurring over the last 8
>>>> weeks. That is a tiny number compared to the 1,000,000 or so
>>>> messages we
>>>> receive per day so the problem seems to arise out of a very
>>> special set
>>>> of circumstances.
>>>>
>>>> Not just mail from 'intl.pepsico.com' is involved although that
>>>> site
>>>> accounts for a significant proportion of the 59 cases. At least two
>>>> different people sending mail from that site have beem affected.
>>>>
>>>> A full extract of log records for one such instance is:
>>>>
>>>> Jun 1 10:12:26 cheviot2 sendmail[25995]: k519CLJN025995:
>>>> from=<xxx.yyy at intl.pepsico.com>, size=2953, class=0, nrcpts=1,
>>>> msgid=<933D22EF8B0CA249BC3C5056C06FCE2201FCBB9D at pepwmu00262.cww
>>>> .pep.pvt>
>>>> , proto=ESMTP, daemon=MTA, relay=pepwmz00096.pbsg.com
>>>> [195.33.104.10]
>>>>
>>>> Jun 1 10:12:26 cheviot2 sendmail[25995]: k519CLJN025995: Milter
>>>> add:
>>>> header: Received-SPF: none (cheviot2.ncl.ac.uk: domain of
>>>> xxx.yyy at intl.pepsico.com does not designate permitted sender hosts)
>>>>
>>>> Jun 1 10:12:26 cheviot2 sendmail[25995]: k519CLJN025995:
>>>> to=<aaa.bbb at newcastle.ac.uk>, delay=00:00:00, mailer=esmtp,
>> pri=32953,
>>>> stat=queued
>>>>
>>>> Jun 1 10:12:39 cheviot2 MailScanner[22318]: Message
>>>> k519CLJN025995 from
>>>> 195.33.104.10 (xxx.yyy at intl.pepsico.com) to newcastle.ac.uk is MCP,
>>>> MCP-Checker (MCP timed out)
>>>>
>>>> Jun 1 10:12:39 cheviot2 MailScanner[22318]: MCP Actions: message
>>>> k519CLJN025995 actions are deliver
>>>>
>>>> At this point the message disappears from the queue. It is not
>>>> delivered
>>>> and the log records above confirm this.
>>>>
>>>> I am running with MailScanner-4.51.6-1 and SpamAssassin 3.1.1.
>>>>
>>>> Quentin
>>>> ---
>>>> PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>>>> University of Newcastle,
>>>> Newcastle upon Tyne,
>>>> FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>>> ---------------------------------------------------------------
>>>> ---------
>>>> Any opinion expressed above is mine and not that of Newcastle
>>>> University.
>>>>
>>>>
>>>>> -----Original Message-----
>>>>> From: mailscanner-bounces at lists.mailscanner.info
>>>>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>>>>> Of Jeremy Blonde
>>>>> Sent: 01 June 2006 17:08
>>>>> To: MailScanner discussion
>>>>> Subject: RE: MCP-Checker (MCP timed out) - what is ahppening?
>>>>>
>>>>> I ran into this same problem. I had to delete my existing mcp
>>>>> rule file
>>>>> and re-create it. Apparently, I had added a typo somewhere.
>>>>>
>>>>>
>>>>> Jeremy Blonde
>>>>> Instructional Technology - Server Support
>>>>> Grant Joint Union School District
>>>>>
>>>>>
>>>>> -----Original Message-----
>>>>> From: mailscanner-bounces at lists.mailscanner.info
>>>>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>>>>> Of Quentin
>>>>> Campbell
>>>>> Sent: Thursday, June 01, 2006 9:00 AM
>>>>> To: mailscanner at lists.mailscanner.info
>>>>> Subject: MCP-Checker (MCP timed out) - what is ahppening?
>>>>>
>>>>> I am seeing for one sender the following record in the logs:
>>>>>
>>>>> Jun 1 10:13:57 cheviot1 MailScanner[425]: Message
>>> k519DcIG001362 from
>>>>> 195.33.10 4.10 (xxx.yyy at intl.pepsico.com) to newcastle.ac.uk is
>>>>> MCP,
>>>>> MCP-Checker (MCP timed out)
>>>>>
>>>>> The mail is disappearing. What might be the cause?
>>>>>
>>>>> Quentin
>>>>> ---
>>>>> PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>>>>> University of Newcastle,
>>>>> Newcastle upon Tyne,
>>>>> FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>>>> ---------------------------------------------------------------
>>>>> ---------
>>>>> Any opinion expressed above is mine and not that of Newcastle
>>>>> University.
>>>>> --
>>>>> MailScanner mailing list
>>>>> mailscanner at lists.mailscanner.info
>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>>
>>>>> Before posting, read http://wiki.mailscanner.info/posting
>>>>>
>>>>> Support MailScanner development - buy the book off the website!
>>>>> --
>>>>> MailScanner mailing list
>>>>> mailscanner at lists.mailscanner.info
>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>>
>>>>> Before posting, read http://wiki.mailscanner.info/posting
>>>>>
>>>>> Support MailScanner development - buy the book off the website!
>>>>>
>>>> --
>>>> MailScanner mailing list
>>>> mailscanner at lists.mailscanner.info
>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>
>>>> Before posting, read http://wiki.mailscanner.info/posting
>>>>
>>>> Support MailScanner development - buy the book off the website!
>>>>
>>> --
>>> MailScanner mailing list
>>> mailscanner at lists.mailscanner.info
>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>> Before posting, read http://wiki.mailscanner.info/posting
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.
More information about the MailScanner
mailing list