Renaud Allard wrote:
> Marc Haber wrote:
> > On Sat, 11 Nov 2006 13:37:52 +0100, Renaud Allard <renaud@???>
> > wrote:
> >> Marc Haber wrote:
> >>> on November 7, I updated spamassassin on my personal Debian stable
> >>> system from (a backported) 3.1.5 to (also backported) 3.1.7. In Debian
> >>> terminology, a backport means that one takes a package from the
> >>> unstable or testing distribution and rebuilds it for use on stable.
> >>>
> >>> Since that backup, I have numerous spamassassin-related error messages
> >>> in my panic log:
> >>>
> >>> 2006-11-07 09:38:11 1GhMTD-0002Ym-He spam acl condition: warning - spamd
connection to 127.0.0.1, port 783 failed: Connection refused
> >>> 2006-11-07 09:38:11 1GhMTD-0002Ym-He spam acl condition: all spamd server
s failed
> >> Obviously, your spamd daemon is not listening on 127.0.0.1.
> >
> > I am not _that_ stupid, thanks for trying to help.
> >
>
> I am sorry, and indeed, it seemed strange to me that _you_ asked such a
> thing.
> So aren't you just hitting your --max-children/--max-conn-per-child
> limit and there are no more spamd servers available?
--max-conn-per-child is the number of connections a child process
will handle before exitting so that it can be re-spawned.
--max-children can be used to throttle the number of simultaneous
connections, well almost. The listen() syscall can set a connection
queue backlog limit. I'm not sure what SA sets this to, but if all
your spamd processes are busy and the listen queue is full, you'll
get a connection refused.
If this is the case, I'd expect your netstat output to look something
like the following.
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 127.0.0.1.43224 127.0.0.1.783 SYN_SENT
tcp4 0 0 127.0.0.1.52187 127.0.0.1.783 SYN_SENT
tcp4 0 0 127.0.0.1.50415 127.0.0.1.783 SYN_SENT
tcp4 0 0 127.0.0.1.58973 127.0.0.1.783 ESTABLISHED
tcp4 0 0 127.0.0.1.49856 127.0.0.1.783 ESTABLISHED
tcp4 0 0 127.0.0.1.51926 127.0.0.1.783 ESTABLISHED
tcp4 0 0 127.0.0.1.58754 127.0.0.1.783 ESTABLISHED
tcp4 0 0 127.0.0.1.58063 127.0.0.1.783 ESTABLISHED
Marc, how often do you get this message? If it's easy to duplicate,
perhaps the output of tcpdump on your loopback interface might help.
Also, what does the SA child process state look like? Ours look
like 'IIBIIIIBIIIIIIBIBIIIIIIIIIIIII' most of the time, but at the
times you get this message, I'd expect 'BBBBB' - all children busy.
This should be easy to verify in your logs.
Hope this helps,
Ian
--
Ian Freislich
