Problems with Mimedefang & Spamassassin

[Matt Yahna]

We currently use the following configuration for blocking Spam:

Solaris 8
Mimedefang 2.41
SpamAssassin 2.63
Perl 5.8
Sendmail 8.12.11

Over the weekend, I noticed several message in the syslog that the milter
timed out, and that some messages were taking several hours to finally get
through the system. We were still blocking spam, but it was taking a long
time. I was getting reports from users that they were not getting messages
from clients, and would see in the log that their message was refused
because the milter was too busy to accept it. This never used to happen, we
would get emails right away even after they went through SA. I have tried
adding more mimedefang instances to the multiplexor, but they just get used
and get busy. I have 20 running right now, and all are busy. Does anyone
have any idea why this just started happening? I thought maybe it was
because of some of the new rules that I installed, but even after turning
most of them off, I still have the problem! I have the following rules
installed (all downloaded recently):

99_FVGT_Tripwire.cf airmax.cf random.current.cf antidrug.cf

backhair.cf sa-blacklist.cf bigevil.cf
sa-blacklist.current.uri.cf bogus-virus-warnings.cf
chickenpox.cf
evilnumbers.cf weeds.cf

I ran a spamassassin -d --lint and receive no errors.

Here are some of the errors in my syslog:

Mar 24 09:33:42 spawn mimedefang-multiplexor: [ID 316382 mail.info] Killing
busy slave 17 (pid 23428): Busy timeout
Mar 24 09:33:42 spawn mimedefang[5240]: [ID 847421 mail.error] Error from
multiplexor: ERR Filter timed out - system may be overloaded (consider
increasing busy timeout)Mar 24 09:33:44 spawn mimedefang-multiplexor: [ID
364399 mail.info] Slave status: Stopped=0 Idle=0 Busy=20 Killed=0 Queued=0
Msgs=3193 Activations=3183Mar 24 09:33:44 spawn sm-mta[23419]: [ID 801593
mail.error] i2OGSDCS023419: Milter (mimedefang): timeout before data read
Mar 24 09:33:45 spawn sm-mta[23419]: [ID 801593 mail.info] i2OGSDCS023419:
Milter (mimedefang): to error state
Mar 24 09:32:10 spawn sm-mta[23532]: [ID 801593 mail.info] i2OGW3iQ023532:
Milter: data, reject=451 4.7.1 Please try again later

Any help would be greatly appreciated.

- Matt

[Lucas Albers]

check your filter or mimedefang rules for some extended regular expression
match that might be slowing it down.
Turn off bayes/network tests.
in spamassassin:
skip_rbl_checks 1
use_bayes 0
auto_learn 0

#whitelist_fro
Turn up sendmail logging.
define(`confLOG_LEVEL',`26')dnl
stop sendmail and mimedefang.
wait 15 seconds.
start mimedefang.
wait 10 seconds
start sendmail.

This will help you track down the problem....

Post by Matt Yahna
Solaris 8
Mimedefang 2.41
SpamAssassin 2.63
Perl 5.8
Sendmail 8.12.11
Mar 24 09:33:42 spawn mimedefang-multiplexor: [ID 316382 mail.info] Killing
busy slave 17 (pid 23428): Busy timeout
Mar 24 09:33:42 spawn mimedefang[5240]: [ID 847421 mail.error] Error from
multiplexor: ERR Filter timed out - system may be overloaded (consider
increasing busy timeout)Mar 24 09:33:44 spawn mimedefang-multiplexor: [ID
364399 mail.info] Slave status: Stopped=0 Idle=0 Busy=20 Killed=0 Queued=0
Msgs=3193 Activations=3183Mar 24 09:33:44 spawn sm-mta[23419]: [ID 801593
mail.error] i2OGSDCS023419: Milter (mimedefang): timeout before data read
Milter (mimedefang): to error state
Milter: data, reject=451 4.7.1 Please try again later
Any help would be greatly appreciated.
- Matt

[Matt Yahna]

Ok, I am officially an idiot. Even though I had downloaded the latest
bigevil.cf file to my system, it was not ftping the new one to my mail
server (was putting version 2.12I on the system). Now that I figured out my
mistake and have put 2.12J on, the problem seems to be fixed. I am adding
all of my filters back one by one to verify that there are no more
conflicts.

Thanks for the help. Guess version 2.12I had a problem (or at least the
version of it that I downloaded).

- Matt

-----Original Message-----
From: Lucas Albers [mailto:***@cs.montana.edu]
Sent: Wednesday, March 24, 2004 10:12 AM
To: spamassassin-***@incubator.apache.org
Subject: Re: Problems with Mimedefang & Spamassassin

check your filter or mimedefang rules for some extended regular expression
match that might be slowing it down.
Turn off bayes/network tests.
in spamassassin:
skip_rbl_checks 1
use_bayes 0
auto_learn 0

#whitelist_fro
Turn up sendmail logging.
define(`confLOG_LEVEL',`26')dnl
stop sendmail and mimedefang.
wait 15 seconds.
start mimedefang.
wait 10 seconds
start sendmail.

This will help you track down the problem....

Post by Matt Yahna
Solaris 8
Mimedefang 2.41
SpamAssassin 2.63
Perl 5.8
Sendmail 8.12.11
Mar 24 09:33:42 spawn mimedefang-multiplexor: [ID 316382 mail.info]
Killing busy slave 17 (pid 23428): Busy timeout Mar 24 09:33:42 spawn
mimedefang[5240]: [ID 847421 mail.error] Error from
multiplexor: ERR Filter timed out - system may be overloaded (consider
[ID
364399 mail.info] Slave status: Stopped=0 Idle=0 Busy=20 Killed=0
Queued=0
Msgs=3193 Activations=3183Mar 24 09:33:44 spawn sm-mta[23419]: [ID
801593 mail.error] i2OGSDCS023419: Milter (mimedefang): timeout before
data read Mar 24 09:33:45 spawn sm-mta[23419]: [ID 801593 mail.info]
Milter (mimedefang): to error state
Milter: data, reject=451 4.7.1 Please try again later
Any help would be greatly appreciated.
- Matt

--
Luke Computer Science System Administrator Security Administrator,College of
Engineering Montana State University-Bozeman,Montana