spamd: server killed by SIGTERM, shutting down

monkey64

Well-Known Member
Nov 6, 2011
108
4
68
cPanel Access Level
Root Administrator
This morning I received the email “FAILED: exim on myserver.com” and another 5 minutes later “RECOVERED: exim on myserver.com”. The fail happened at 04:33 and the restart happened at 04:38 yet /var/log/mailog shows activity within this timeframe so I am not sure whether this is just a false positive.

Contents of /var/log/mailog at the time of the faiil:

Code:
Dec 21 04:33:24 myserver spamd[1245]: spamd: processing message <[email protected]> for cpanel:32001
Dec 21 04:33:25 myserver spamd[1245]: spamd: identified spam (1000.0/5.0) for cpanel:32001 in 1.1 seconds, 834 bytes.
Dec 21 04:33:25 myserver spamd[1245]: spamd: result: Y 999 - GTUBE,NO_RECEIVED,NO_RELAYS scantime=1.1,size=834,user=cpanel,uid=32001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=43625,mid=<[email protected]>,autolearn=no autolearn_force=no,shortcircuit=no
Dec 21 04:33:25 myserver spamd[16859]: prefork: child states: I
Dec 21 04:33:26 myserver dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__3vxk0gombz4vm624fnoqtkaqbjx4thgfuixgv2mml_z05o...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=13554, secured, session=<+eJhcbIKwQB/AAAB>
Dec 21 04:33:26 myserver dovecot: imap(__cpanel__service__auth__imap__3vxk0gombz4vm624fnoqtkaqbjx4thgfuixgv2mml_z05o53tetgod3uzxj28zzz): Disconnected: Logged out in=11, out=417, bytes=11/417
Dec 21 04:33:29 myserver spamd[16859]: spamd: server killed by SIGTERM, shutting down
Dec 21 04:33:41 myserver spamd[13640]: logger: removing stderr method
Dec 21 04:33:43 myserver spamd[13645]: zoom: able to use 350/350 'body_0' compiled rules (100%)
Dec 21 04:33:44 myserver spamd[13645]: spamd: server started on IO::Socket::INET6 [127.0.0.1]:783 (running version 3.4.0)
Dec 21 04:33:44 myserver spamd[13645]: spamd: server pid: 13645
Dec 21 04:33:44 myserver spamd[13645]: spamd: server successfully spawned child process, pid 13653
Dec 21 04:33:44 myserver spamd[13645]: prefork: child states: I
The line spamd: server killed by SIGTERM, shutting down seems to suggest that SpamAssasin may have something to do with the issue so here is the output from spamd - V

Code:
SpamAssassin Server version 3.3.1
  running on Perl 5.10.1
Dec 22 08:18:50.538 [15808] error: Socket version 1.95 required--this is only version 1.82 at /usr/local/share/perl5/IO/Socket/SSL.pm line 71.
Dec 22 08:18:50.543 [15808] error: Can't locate IO/Socket/IP.pm in @INC (@INC contains: /usr/local/share/perl5 /usr/local/lib64/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5) at /usr/local/share/perl5/IO/Socket/SSL.pm line 85.
  with SSL support (IO::Socket::SSL 1.79_01)
  with zlib support (Compress::Zlib 2.021)
[email protected] [~]#
Contents of Failure email:

Code:
Notification Type: 	failed
Notification: 	exim failed @ Sun Dec 21 04:33:23 2014. A restart was attempted automagically.
Service Check Method: 	[check command]
Number of Restart Attempts: 	1
Service Check Raw Output: 	

Exim is not running

Startup Log: 	

Starting clamd: [  OK  ]
Starting exim: [  OK  ]
0 processes (antirelayd) sent signal 9
/usr/local/cpanel/scripts/update_sa_rules: running in background

Log Messages: 	

2014-12-21 04:30:18 exim 4.84 daemon started: pid=16803, -q1h, listening for SMTP on port 25 (IPv6 and IPv4) port 26 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)

Memory Information: 	

    Used: 466MB
    Available: 1533MB
    Installed: 2000MB 

Load Information: 	0.06 0.14 0.10
Uptime: 	159 days, 2 hours, 35 seconds
IOStat Information: 	

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           2.78    0.34    0.56    1.18    0.02   95.12
Device:            tps   Blk_read/s   Blk_wrtn/s   Blk_read   Blk_wrtn
xvdap1           16.14       625.54       211.36 8599217674 2905519320

ChkServd Version: 	15.6
Contents of restart email:

Code:
Service: 	exim
Notification Type: 	recovered
Notification: 	exim check was successful after restart.
Reason: 	

TCP Transaction Log: 
<< 220-myserver.com ESMTP Exim 4.84 #2 Sun, 21 Dec 2014 04:38:30 +0000 
<< 
<< 
>> EHLO localhost
<< 250-myserver.com Hello localhost [127.0.0.1]
<< 
<< 
<< 
<< 
<< 
<< 
>> AUTH PLAIN AF9fY3BhbmVsX19zZXJ2aWNlX19hdXRoX19leGltX19ZUjVza0Jic18xclNMNnd5RkI0VXlBYjJvWllINGZXeGJYUlNoTk1wUkxjS2hFbU1hVlRHb1pDeUpfS0JTTjZfAFJCdDluajRlOXFDbkl6U0hReE9OYUNkNFlSQXRMTUUyT3ZsdG8yeDFBUldPeTJqSVZ4Q3hfamlwVHd5MmRaZ1U=
<< 235 Authentication succeeded
>> QUIT
<< 221 myserver.com closing connection

Startup Log: 	

Starting clamd: [  OK  ]
Starting exim: [  OK  ]
0 processes (antirelayd) sent signal 9
/usr/local/cpanel/scripts/update_sa_rules: running in background

Log Messages: 	

2014-12-21 04:33:40 exim 4.84 daemon started: pid=13624, -q1h, listening for SMTP on port 25 (IPv6 and IPv4) port 26 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)
2014-12-21 04:30:18 exim 4.84 daemon started: pid=16803, -q1h, listening for SMTP on port 25 (IPv6 and IPv4) port 26 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)

Memory Information: 	

    Used: 813MB
    Available: 1187MB
    Installed: 2000MB 

Load Information: 	0.08 0.11 0.10
Uptime: 	159 days, 2 hours, 40 seconds
IOStat Information: 	

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           2.78    0.34    0.56    1.18    0.02   95.12
Device:            tps   Blk_read/s   Blk_wrtn/s   Blk_read   Blk_wrtn
xvdap1           16.14       625.57       211.35 8599808282 2905532448

ChkServd Version: 	15.6
Can anyone offer any assistance?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,910
2,213
363
Hello :)

Could you let us know the output from /var/log/exim_mainlog and /var/log/exim_paniclog at the time of the failure?

Thank you.
 

monkey64

Well-Known Member
Nov 6, 2011
108
4
68
cPanel Access Level
Root Administrator
Hello :)

Could you let us know the output from /var/log/exim_mainlog and /var/log/exim_paniclog at the time of the failure?

Thank you.
The failiure was at 04:33:23 2014.

/var/log/exim_mainlog

Code:
2014-12-21 04:32:02 cwd=/home/folder/public_html/file-room 3 args: /usr/sbin/sendmail -t -i
2014-12-21 04:32:02 1Y2YBW-0003Ve-Pc <= [email protected] U=nobody P=local S=1428 [email protected] T="[Woordpress: \"Kampala_12\"" for [email protected]
2014-12-21 04:32:02 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Y2YBW-0003Ve-Pc
2014-12-21 04:32:02 1Y2YBW-0003Ve-Pc => /dev/null <[email protected]> R=virtual_user_filter T=**bypassed**
2014-12-21 04:32:02 1Y2YBW-0003Ve-Pc Completed
2014-12-21 04:33:29 cwd=/ 2 args: /usr/sbin/sendmail -t
2014-12-21 04:33:30 1Y2YCv-0003XN-RU <= [email protected] U=root P=local S=14624 T="FAILED: exim on myserver (11.22.33.44)" for [email protected]
2014-12-21 04:33:30 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Y2YCv-0003XN-RU
2014-12-21 04:33:30 1Y2YCv-0003XN-RU => name <[email protected]> R=virtual_user T=virtual_userdelivery
2014-12-21 04:33:30 1Y2YCv-0003XN-RU Completed
2014-12-21 04:33:40 cwd=/ 3 args: /usr/sbin/exim -bd -q60m
2014-12-21 04:33:40 exim 4.84 daemon started: pid=13624, -q1h, listening for SMTP on port 25 (IPv6 and IPv4) port 26 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)
2014-12-21 04:33:40 cwd=/var/spool/exim 2 args: /usr/sbin/exim -q
2014-12-21 04:33:40 Start queue run: pid=13625
2014-12-21 04:33:41 End queue run: pid=13625
2014-12-21 04:35:23 cwd=/etc/csf 2 args: /usr/sbin/exim -bpc
2014-12-21 04:38:28 SMTP connection from [127.0.0.1]:49995 (TCP/IP connection count = 1)
2014-12-21 04:38:30 SMTP connection from localhost [127.0.0.1]:49995 closed by QUIT
2014-12-21 04:38:30 SMTP connection from [127.0.0.1]:42029 (TCP/IP connection count = 1)
2014-12-21 04:38:31 SMTP connection from localhost [127.0.0.1]:42029 closed by QUIT
2014-12-21 04:38:32 cwd=/ 2 args: /usr/sbin/sendmail -t
/var/log/exim_paniclog

Nothing found in exim_paniclog at the time of the failure.

Thanks
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,910
2,213
363
I don't see any indication of why Exim failed based on the output provided. Has it happened again, and if so, how frequent are the failures?

Thank you.