Spamd keeps failing -- Please help

[faramarza]

Hi

For the past few days I keep getting emails that spamd is failing...

I have restarted exim, No Luck
I have tried re-installing cpanel, No Luck
I have tried fixing spamd update, No Luck



The emails are

spamd failed @ Wed Mar 28 07:33:33 2012. A restart was attempted automagically.

Service Check Method: [check command]

Number of Restart Attempts: 717

Cmd Service Check Raw Output: Spamd is not running Raw Output:


As you see there is nothing else after the Raw Output

I am going crazy with 717 messages and more coming every 5 min


Please help

[storminternet]

Have you enabled SpamAssassin spam filter from WHM Main >> Server Configuration >> Tweak Settings.
Sometimes server shows spamd status failed if SpamAssassin spam filter is not enabled.

[faramarza]

Hi storminternet

Yes that is enabled too.... This started happening just a few days ago... before that all was well

[daveharris]

Hi I'm getting the same thing, have you progressed any?

This fixes it for a short time

sa-learn -D --force-expire
sa-update -D
/usr/local/cpanel/scripts/spamassassin_dbm_cleaner
/usr/local/cpanel/scripts/fixspamassassinfailedupdate
/scripts/restartsrv_spamd

but it fails again some hours later.

[cPanelTristan]

Have you submitted a ticket? We've gotten some recent tickets on spamd issues and I highly suggest anyone experiencing an issue with spamd failing to submit a ticket. Posting the ticket number here would be very helpful. Please do note what you've done in the ticket upon opening it so that the measures to fix it so far are known (and that those measures only work short-term). Thanks!

[kwevers]

I also have been experiencing the same problem.
I've opened a ticket (2511550) and the error was according to cPanel support related to a hardware issue.
This seems very strange to me as the only thing the cPanel server sees is virtual hardware presented by Qemu/KVM.
The error found in the core dump is a SIGKILL, according to cPanel support related to the SSE2 instruction set.
Both the physical cpu of the machine (Opteron 6128) the vm is hosted on as the vm itself report both SSE and SSE2 instruction sets as available.

To me it seems that wrong input is provided to the convert string to float function mentioned in the extract hereunder.
A SIGKILL doesn't necessary mean the instruction doesn't exist.

This issue appears to be hardware related.

Even after reinstalling SpamAssassin, the issue still occurs:

[root@s003 ~/cpjeff]# spamc < gtube
Illegal instruction (core dumped)


"Illegal instruction" refers to a processor (CPU) instruction.

Here's what happens when we inspect the coredump that was left
behind:

[root@s003 ~/cpjeff]# gdb -c core.9645 /usr/local/bin/spamc

(gdb) bt
#0 0x0000000000405020 in _locale_safe_string_to_float ()
#1 0x00000000004061ff in message_filter ()
#2 0x0000000000402bff in main ()

(gdb) disas _locale_safe_string_to_float
Dump of assembler code for function _locale_safe_string_to_float:
(...)
0x0000000000405017 <+74>: callq 0x401640 <strtol@plt>
0x000000000040501c <+79>: mov %rax,-0x48(%rbp)
=> 0x0000000000405020 <+83>: vcvtsi2ssq -0x48(%rbp),%xmm0,%xmm0


So, your CPU is attempting to convert a string into a float using the
vcvtsi2ssq instruction from the SSE2 instruction set, and the process is killed
by your own server:

33347 5166 --- SIGILL (Illegal instruction) @ 0 (0) ---

Unfortunately there isn't anything that we can do regarding this issue.
I would recommend contacting your server provider to see if they are
aware of any similar issues, perhaps related to the QEMU Virtual CPU
your server is using.

I hope this information is helpful.

[PPNSteve]

Still happening on one of my boxes.. no idea what's causing it.. Any solution reached yet?

spamd failed @ Wed Jun 20 18:36:56 2012. A restart was attempted automagically.

Service Check Method: [check command]

Number of Restart Attempts: 1

Cmd Service Check Raw Output: Spamd is not running
Raw Output:


Syslog Messages: Jun 20 18:36:01 svr3 spamd[27763]: spamd: connection from localhost [127.0.0.1] at port 59483
Jun 20 18:36:01 svr3 spamd[27763]: spamd: setuid to rpgusa succeeded
Jun 20 18:36:01 svr3 spamd[27763]: spamd: checking message <31809885.1340217367172.JavaMail.rlsmgr@dc01app10> for rpgusa:524
Jun 20 18:36:02 svr3 spamd[27763]: spamd: clean message (0.9/5.0) for rpgusa:524 in 0.5 seconds, 3244 bytes.
Jun 20 18:36:02 svr3 spamd[27763]: spamd: result: . 0 - AWL,BAYES_00,HTML_IMAGE_ONLY_24,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,LOTS_OF_MONEY,MIME_HTML_ONLY,SPF_PASS,T_REMOTE_IMAGE,T_RP_MATCHES_RCVD scantime=0.5,size=3244,user=rpgusa,uid=524,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=59483,mid=<31809885.1340217367172.JavaMail.rlsmgr@dc01app10>,bayes=0.000000,autolearn=no,shortcircuit=no
Jun 20 18:36:02 svr3 spamd[20523]: prefork: child states: II
Jun 20 18:36:32 svr3 spamd[27763]: spamd: connection from localhost [127.0.0.1] at port 59496
Jun 20 18:36:32 svr3 spamd[27763]: spamd: setuid to rpgusa succeeded
Jun 20 18:36:32 svr3 spamd[30527]: spamd: connection from localhost [127.0.0.1] at port 59497
Jun 20 18:36:32 svr3 spamd[30527]: spamd: setuid to fdnbiz succeeded
Jun 20 18:36:33 svr3 spamd[27763]: spamd: checking message <003501cd4f13$7be21740$73a645c0$@hogarhispano.org> for rpgusa:524
Jun 20 18:36:33 svr3 spamd[30527]: spamd: checking message <003501cd4f13$7be21740$73a645c0$@hogarhispano.org> for fdnbiz:512

---------------------=======================------------------------

spamd failed @ Wed Jun 20 19:33:13 2012. A restart was attempted automagically.

Service Check Method: [check command]

Number of Restart Attempts: 12


Cmd Service Check Raw Output: Spamd is not running
Raw Output: Subject: Test spam mail (GTUBE)
Message-ID: <GTUBE1.1010101@example.net>
Date: Wed, 23 Jul 2003 23:30:00 +0200
From: Sender <sender@example.net>
To: Recipient <recipient@example.net>
Precedence: junk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

This is the GTUBE, the
Generic
Test for
Unsolicited
Bulk
Email

If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting incoming
spam. You can send yourself a test mail containing the following string of
characters (in upper case and with no white spaces and line breaks):

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

You should send this test mail from an account outside of your network.

[cPanelTristan]

Opening up a ticket is the best way to go on this one.

[techs4gnu]

We are facing the "spamd failing issue". Is there any specific solution for resolving this issue ?

[PPNSteve]

ticket 2909179 submitted.

[acenetgeorge]

We've had a similar problem on a couple of dedicated servers here, and I was able to fix the problem by running:

/scripts/fixspamassassinfailedupdate

[tuibm]

Same problem Here, ticket: 3531541