The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Excessive Spam Assassin Usage?

Discussion in 'General Discussion' started by urantian, Sep 2, 2009.

  1. urantian

    urantian Well-Known Member

    Joined:
    Jan 26, 2005
    Messages:
    88
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Fayetteville, Arkansas
    cPanel Access Level:
    Root Administrator
    I'm not sure whether my question pertains to WHM or Addons. I installed CSF (ConfigServer Firewall), and have not yet fully configured everything.

    I am frequently getting emails regarding Spam Assassin, such as this:

    Code:
    Time:    Wed Sep  2 14:03:30 2009 -0700
    PID:     3020
    Account: <username>
    Uptime:  4896 seconds
    
    Executable:
    /usr/bin/perl
    
    Command Line (often faked in exploits):
    spamd child
    Another message follows, such as this:

    Code:
    Time:         Wed Sep  2 14:03:31 2009 -0700
    Account:      <username>
    Resource:     Process Time
    Exceeded:     4896 > 1800 (seconds)
    Executable:   /usr/bin/perl
    Command Line: spamd child
    PID:          3020
    Killed:       No
    It seems to be spending a lot of time running processes. Am I having a problem with SpamAssassin, or do I still have some configuring to do?

    ---Michael
     
  2. Spiral

    Spiral BANNED

    Joined:
    Jun 24, 2005
    Messages:
    2,023
    Likes Received:
    7
    Trophy Points:
    0
    Spamassassin spawns processes for most every message that comes into your server so LFD is going to see it running each time it checks so it's not uncommon to get a lot of "spamd" notices from LFD (Part of CSF).

    I'd recommend configuring LFD/CSF to ignore that particular process as
    you generally don't need to be notified about Spamassassin constantly
    and notices should really be left to more serious alerts.

    Anyway though, no you probably don't have anything wrong with your
    Spamassassin. LFD is just simply a little over sensitive sometimes.
     
  3. urantian

    urantian Well-Known Member

    Joined:
    Jan 26, 2005
    Messages:
    88
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Fayetteville, Arkansas
    cPanel Access Level:
    Root Administrator
    Thank you for the quick response. I'm relieved that this appears normal.

    However, I'm curious about why the processes require so much time---nearly 5,000 seconds to process messages? Is this because the instance stays active between message processes?

    ---Michael
     
  4. Spiral

    Spiral BANNED

    Joined:
    Jun 24, 2005
    Messages:
    2,023
    Likes Received:
    7
    Trophy Points:
    0
    Bingo! LFD is simply worried about what is actually a normal server process! ;)
     
  5. urantian

    urantian Well-Known Member

    Joined:
    Jan 26, 2005
    Messages:
    88
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Fayetteville, Arkansas
    cPanel Access Level:
    Root Administrator
    Great! As always... thank you for your assistance.

    ---Michael
     
  6. urantian

    urantian Well-Known Member

    Joined:
    Jan 26, 2005
    Messages:
    88
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Fayetteville, Arkansas
    cPanel Access Level:
    Root Administrator
    Which option on the "Edit ConfigServer Firewall" page would be used to disable the SpamAssassin notifications? Or, is it a command-line option?

    ---Michael
     
  7. cookiesunshinex

    cookiesunshinex Well-Known Member

    Joined:
    Jun 10, 2005
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    6
Loading...

Share This Page