Spam Assasin Timeouts

[Mogens Melander]

Hi all

I'm also seeing "a lot" of "Message Content Protection SpamAssassin timed out and was killed".

The number of messages recieved per day is stable between 1500 and 2500.

I've been looking at log-files, and can't find anyting to put my finger on, other than the number
of timeout's per date, and system load (increased from 0.1 to 0.3):

"Mar 10"   0 timeout's
"Mar 11"   0 timeout's
"Mar 12"   0 timeout's (Updated from MailScanner-4.60.8 to MailScanner-4.67.6-1)
"Mar 13"   0 timeout's
"Mar 14"   0 timeout's
"Mar 15"   0 timeout's
"Mar 16"  82 timeout's
"Mar 17" 141 timeout's
"Mar 18"  45 timeout's
"Mar 19" 156 timeout's
"Mar 20" 130 timeout's
"Mar 21" 110 timeout's
"Mar 22" 723 timeout's

Hmm, watching the maillog scroll up on the console, i notice that every "MCP Checks: Starting"
results in a timeout.

The only (i think) non standard stuff i got, is a few rules in
/etc/mail/spamassassin minus the (scramble) part ;^)

fumlersoft.cf :

body      I_AM_NICE_GIRL  /(scramble)I am nice girl/i
describe  I_AM_NICE_GIRL  I am nice girl that would like to chat with you. score    
I_AM_NICE_GIRL  5.0

body      JERTECH_RULE1   /(scramble)jertechinc.com/i
describe  JERTECH_RULE1   JERTECH INC Advanced fee scam.
score     JERTECH_RULE1   5.0

body      JERTECH_RULE2   /(scramble)JerTech Inc/i
describe  JERTECH_RULE2   JerTech Inc - Advanced fee scam.
score     JERTECH_RULE2   5.0

body      BLOGSPOT_RULE1  /(scramble)blogspot.com/i
describe  BLOGSPOT_RULE1  blocspot.com - promotes porn sites.
score     BLOGSPOT_RULE1  5.0

header    MBM_KOI8_RULE1  Subject =~ /(scramble)koi8-/i
describe  MBM_KOI8_RULE1  Filter for Cyrilic (KOI8) stuff.
score     MBM_KOI8_RULE1  5.0

body      MBM_KOI8_RULE2  /(scramble)koi8-/i
describe  MBM_KOI8_RULE2  Filter for Cyrilic (KOI8) stuff.
score     MBM_KOI8_RULE2  5.0

Any ideas to where i should start to look, would be greately apreaciated.

On Mon, March 10, 2008 14:26, Gareth wrote:
> I scan about 1000 messages per day and get about 1-3 timeouts.
> I do run lots of additional rules though.
>
> On Mon, 2008-03-10 at 12:43, Paul Houselander (SME) wrote:
>> Hi List
>>
>>
>>
>> I get a few complaints from users that Spam has got through, quite often when I investigate the
message I can see in the logs that that SpamAssassin timed out and therefore scored zero.
>>
>>
>>
>> Looking at logwatch an average day I would see
>>
>>
>>
>> 20166 messages Scanned by MailScanner
>>
>> 170 SpamAssassin timeout(s)
>>
>>
>>
>> Im just after tips as to how to troubleshoot/minimize timeouts, sometimes ive managed to get a
copy of the message and ran
>> spamassasin –t –D < message and it works and scores fine,
>> I don't think its down to load as the load average rarely goes
>> above 3.00 on this server. I also run a caching name server
>>
>>
>>
>> Ive also tried upping the SpamAssasin timeout from 60 to 120?
>>
>>
>>
>> Any other tips? I was thinking perhaps an option if spamassasin times out the message could be
put back in mqueue.in for a further attempt to scan the message?
>>
>>
>>
>> Kind Regards
>>
>>
>>
>> Paul
>>

-- 
Later

Mogens Melander
+45 40 85 71 38
+66 870 133 224



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.