cmd= on exim ?

[maxihost3]

Hello,

I see that my spamd is going down very often and just realized that while tailing /var/log/exim_mainlog I can see weird messages that I never saw before on other servers

they are:

lots of:
2006-10-19 17:24:10 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1GaeQq-0007Eh-21

I saw also:
2006-10-19 17:25:07 cwd=/ 2 args: /usr/sbin/sendmail -t

while cleaning queue:
cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -Mrm 1GaeHG-00088k-5C

Ps: Message IDs change, I just paste some examples

What exactly is this ? Who is calling these commands ? Are them normal ?

 

[maxihost3]

I saw one saying either:

2006-10-19 17:27:11 1GaeTt-0007lE-Mk demime acl condition: base64 line length exceeds 76 characters

 

[Rafaelfpviana]

Thease messages are complety normal.

Notice that there is no CMD there, as you can see its CWD = Current Working Directory, meaning, where the script was sent from, this helps out to find out who sent it.

You can track the message using the ID of the messages and the timestamps.

 

[nyjimbo]

Hello,

I see that my spamd is going down very often..................

Do you mean spamd dying and dumping core ?. If so this is sometimes due to spamd not being able to handle a load or dying on a condition. Can you look at the headers of one of your messages and see what version of spamassassin you are running. We had a machine we thought was updating but was quite old. When we upgraded SA the dumping went away.