spamd: server killed by SIGTERM, shutting down

MindServer · Sep 27, 2020

Hi,

I'm receiving this warning every day: spamd: server killed by SIGTERM, shutting down

I searched in google and saw that more people have same warning, but I not found any solution.

Why happen this?; this is a error/problem?.

Thank you very much. Have a nice day.

cPanelLauren · Oct 1, 2020

Hi @MindServer

Is anything of note occurring in /var/log/messages at the time of the shutdown of spamd? Or is the server under any kind of load when this occurs?

MindServer · Oct 1, 2020

cPanelLauren said:
Hi @MindServer

Is anything of note occurring in /var/log/messages at the time of the shutdown of spamd? Or is the server under any kind of load when this occurs?

Thank you very much for reply me, this is the info in "/var/log/messages" at the same moment:

Code:

Oct  1 01:34:09 kernel: Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:17 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:19 kernel: Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:19 kernel: Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:20 kernel: Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:21 kernel: Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:23 systemd: Stopping System Logging Service...
Oct  1 01:34:23 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-52.el7_8.2" x-pid="27030" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct  1 01:34:23 systemd: Stopped System Logging Service.
Oct  1 01:34:23 systemd: Starting System Logging Service...
Oct  1 01:34:23 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-52.el7_8.2" x-pid="2332" x-info="http://www.rsyslog.com"] start


------------ THIS HAPPENS AT THE SAME TIME ------------

Oct  1 01:34:23 systemd: Started System Logging Service.
Oct  1 01:34:24 systemd: Stopping Apache SpamAssassin™ deferral daemon...
Oct  1 01:34:24 systemd: Stopped Apache SpamAssassin™ deferral daemon.
Oct  1 01:34:24 systemd: Starting Apache SpamAssassin™ deferral daemon...
Oct  1 01:34:25 systemd: Removed slice User Slice of root.
Oct  1 01:34:27 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:27 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:28 systemd: Started Apache SpamAssassin™ deferral daemon.
Oct  1 01:34:37 kernel: Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:40 kernel: Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:42 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:34:44 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:35:00 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  1 01:35:01 systemd: Created slice User Slice of root.

-----------------------------------------------------------------------------

Oct  1 01:35:01 systemd: Started Session c204694 of user root.
Oct  1 01:35:01 systemd: Started Session c204695 of user root.
Oct  1 01:35:01 systemd: Started Session c204696 of user root.
Oct  1 01:35:01 systemd: Started Session c204697 of user root.
Oct  1 01:35:01 systemd: Started Session c204698 of user root.
Oct  1 01:35:01 systemd: Started Session c204699 of user root.
Oct  1 01:35:01 systemd: Started Session c204700 of user root.
Oct  1 01:35:01 systemd: Started Session c204701 of user root.
Oct  1 01:35:01 systemd: Started Session c204702 of user root.
Oct  1 01:35:01 systemd: Started Session c204703 of user root.
Oct  1 01:35:01 systemd: Started Session c204704 of user root.
Oct  1 01:35:01 systemd: Started Session c204705 of user root.
Oct  1 01:35:01 systemd: Started Session c204706 of user root.
Oct  1 01:35:01 systemd: Started Session c204707 of user root.
Oct  1 01:35:01 systemd: Started Session c204708 of user root.
Oct  1 01:35:01 systemd: Started Session c204709 of user root.
Oct  1 01:35:01 systemd: Started Session c204710 of user root.
Oct  1 01:35:01 systemd: Started Session c204711 of user root.
Oct  1 01:35:01 systemd: Started Session c204712 of user root.
Oct  1 01:35:01 systemd: Started Imunify360 notifications service.
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 read 4 default templates
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 read 0 custom templates
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 read 4 templates total
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 reading templates error: open /etc/imunify360/emails/: no such file or directory
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 starting, version 1.0.5-1
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 waiting for a connection/timeout
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 new connection accepted
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 waiting for a connection/timeout
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 new connection accepted
Oct  1 01:35:01 imunify-notifier: 2020/10/01 01:35:01 waiting for a connection/timeout
Oct  1 01:35:04 systemd: Removed slice User Slice of root.

Have a nice day.

cPanelLauren · Oct 6, 2020

Is this always accompanied by an rsyslogd shutdown? Or is that just a one-off? The service is being gracefully restarted by systemd from this output.

It's actually very likely this is being done by Imunify. Do these shutdowns happen when it's not running? Is anything output in /var/log/maillog or the imunify360 log files, there are several in /var/log/?

MindServer · Oct 7, 2020

cPanelLauren said:
Is this always accompanied by an rsyslogd shutdown? Or is that just a one-off? The service is being gracefully restarted by systemd from this output.

It's actually very likely this is being done by Imunify. Do these shutdowns happen when it's not running? Is anything output in /var/log/maillog or the imunify360 log files, there are several in /var/log/?

Hi,

Thank you for your help. I will reply your questions:

-This happens every day at the same hour: 1:34h

-Always when this happens appear similar messages in "/var/log/messages", you can see other example here: Oct 5 01:34:16 spamd[22904]: spamd: server killed by SIGTERM, shutting down

Code:

Oct  5 01:33:02 systemd: Time has been changed
Oct  5 01:33:12 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:33:15 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:33:15 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:33:43 kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:33:55 kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:33:55 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:34:01 systemd: Started Session c260177 of user root.
Oct  5 01:34:01 systemd: Started Session c260178 of user root.
Oct  5 01:34:01 systemd: Started Session c260179 of user root.
Oct  5 01:34:01 systemd: Started Session c260180 of user root.
Oct  5 01:34:01 systemd: Started Session c260181 of user root.
Oct  5 01:34:01 systemd: Started Session c260182 of user root.
Oct  5 01:34:01 systemd: Started Session c260183 of user root.
Oct  5 01:34:09 chronyd[921]: Source 2001:41d0:d:db9::1 replaced with 2001:****** (I hidden the information)
Oct  5 01:34:10 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:34:11 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)

------------ THIS HAPPENS AT THE SAME TIME ------------

Oct  5 01:34:16 systemd: Stopping Apache SpamAssassin™ deferral daemon...
Oct  5 01:34:16 systemd: Stopped Apache SpamAssassin™ deferral daemon.
Oct  5 01:34:16 systemd: Starting Apache SpamAssassin™ deferral daemon...
Oct  5 01:34:17 systemd: Stopping System Logging Service...
Oct  5 01:34:17 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-52.el7_8.2" x-pid="24473" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct  5 01:34:17 systemd: Stopped System Logging Service.
Oct  5 01:34:17 systemd: Starting System Logging Service...
Oct  5 01:34:17 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-52.el7_8.2" x-pid="31534" x-info="http://www.rsyslog.com"] start
Oct  5 01:34:17 systemd: Started System Logging Service.
Oct  5 01:34:19 systemd: Removed slice User Slice of root.
Oct  5 01:34:20 systemd: Started Apache SpamAssassin™ deferral daemon.
Oct  5 01:34:37 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:34:40 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:34:42 kernel: im360-blacklist IN=eth0 OUT= MAC=****** (I hidden the information)
Oct  5 01:34:49 kernel: Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=****** (I hidden the information)

-----------------------------------------------------------------------------

Oct  5 01:35:01 systemd: Created slice User Slice of root.
Oct  5 01:35:01 systemd: Started Session c260184 of user root.
Oct  5 01:35:01 systemd: Started Session c260185 of user root.
Oct  5 01:35:01 systemd: Started Session c260186 of user root.
Oct  5 01:35:01 systemd: Started Session c260187 of user root.
Oct  5 01:35:01 systemd: Started Session c260188 of user root.
Oct  5 01:35:01 systemd: Started Session c260189 of user root.
Oct  5 01:35:01 systemd: Started Session c260190 of user root.
Oct  5 01:35:01 systemd: Started Session c260191 of user root.
Oct  5 01:35:01 systemd: Started Session c260192 of user root.
Oct  5 01:35:01 systemd: Started Session c260193 of user root.
Oct  5 01:35:01 systemd: Started Session c260194 of user root.
Oct  5 01:35:01 systemd: Started Session c260195 of user root.
Oct  5 01:35:01 systemd: Started Session c260196 of user root.
Oct  5 01:35:01 systemd: Started Session c260197 of user root.
Oct  5 01:35:01 systemd: Started Session c260198 of user root.
Oct  5 01:35:01 systemd: Started Session c260199 of user root.
Oct  5 01:35:01 systemd: Started Session c260200 of user root.
Oct  5 01:35:01 systemd: Started Session c260201 of user root.
Oct  5 01:35:01 systemd: Started Session c260202 of user root.

-In "/var/log/maillog" have this messages at the same time:

Code:

Oct  5 01:30:08 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<27224><1E8Xv+Cw9NR/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct  5 01:34:16 spamd[22904]: prefork: child states: II [... logline repeated 174 times]
Oct  5 01:34:16 spamd[22904]: spamd: server killed by SIGTERM, shutting down
Oct  5 01:34:17 spamd[30101]: zoom: able to use 1138/1140 'body_0' compiled rules (99.824%)
Oct  5 01:34:18 spamd[30101]: rules: meta test KAM_DRUG has dependency 'KAM_REPLACE' with a zero score
Oct  5 01:34:18 spamd[30101]: rules: meta test HELO_DYNAMIC_HCC has dependency 'HELO_STATIC_HOST' with a zero score
Oct  5 01:34:18 spamd[30101]: rules: meta test BODY_EMPTY has dependency 'NO_RELAYS' with a zero score
Oct  5 01:34:18 spamd[30101]: rules: meta test KAM_TIMEGEO has dependency 'KAM_GEO_STRING2' with a zero score
Oct  5 01:34:18 spamd[30101]: rules: meta test KAM_INSURE has dependency 'CBJ_GiveMeABreak' with a zero score
Oct  5 01:34:18 spamd[30101]: rules: meta test KAM_NOTIFY2 has dependency 'KAM_IFRAME' with a zero score
Oct  5 01:34:18 spamd[30101]: rules: meta test KAM_AUTONEW2 has dependency 'KAM_NEWNOTICE' with a zero score

ETC. Have many similar lines.

Thank you very much. Have a nice day.

cPanelLauren · Oct 20, 2020

I think more importantly the imunify log files would be helpful here as well.

MindServer · Oct 21, 2020

cPanelLauren said:
I think more importantly the imunify log files would be helpful here as well.

Thank you very much.

In Imunify360 panel appear this message:

Oct 20 05:03:00 hostname spamd[103694]: spamd: server killed by SIGTERM, shutting down
Sensor: ossec Rule: 1008

Maybe you need the logs in "/var/log/"?, Imunify360 have various file logs, whichone you want I copy?.

Thank you again. Have a nice day.

cPanelLauren · Oct 21, 2020

Actually I think that explains it completely without having to look at the logs. Imunify is shutting SpamD down and that's why you're getting that notice.

MindServer · Oct 21, 2020

cPanelLauren said:
Actually I think that explains it completely without having to look at the logs. Imunify is shutting SpamD down and that's why you're getting that notice.

Thank you very much. But I want to understand:

-This is a normal task and happens in all servers?, or is a error/problem?.
-I contacted Imunify360 support and they told me this:

This message generates by OSSEC module, that parses a lot of log files, includes /var/log/messages, this event has low severity

Rules Classification — OSSEC

In case if you need to know more about this you should refer to the corresponded log, it seems related to the SpamAssassin module,

In my other message I copied /var/log/messages, but I did not find anything. They told that this could be related with SpamAssassin.

Thank you again. Have a nice day.

cPanelLauren · Oct 23, 2020

Actually.....I think we're both wrong. This isn't Imunify and it certainly isn't spamd shutting itself down. I misunderstood what this was:

Code:
Code:

Sensor: ossec Rule: 1008

OSSEC is a 3rd party Open Source Host-based Intrusion Detection System OSSEC Documentation — OSSEC - basically it just monitors logs and reports events. But neither the maillog nor /var/log/messages explain why spamd is being killed. The output for the spamd service is:

Code:

Oct  5 01:34:16 spamd[22904]: spamd: server killed by SIGTERM, shutting down

Which indicates something killed the process. What is present in the maillog just prior to spamd being shut down?

MindServer · Oct 23, 2020

Thank you very much. I copy the log here:

KILL HOUR: Oct 20 00:01:51 spamd[736449]: spamd: server killed by SIGTERM, shutting down

/var/log/maillog

Oct 19 23:58:05 spamd[738530]: spamd: connection from localhost [::1]:48480 to port 783, fd 5
Oct 19 23:58:05 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<9jeBNQ2ylHx/AAAB>
Oct 19 23:58:05 dovecot: lmtp(979263): Connect from local
Oct 19 23:58:05 dovecot: lmtp(979263): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 23:58:05 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=979276, secured, session=<R8mENQ2yNuN/AAAB>
Oct 19 23:58:05 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<979276><R8mENQ2yNuN/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 20 00:01:51 spamd[736449]: prefork: child states: II [... logline repeated 157 times]
Oct 20 00:01:51 spamd[736449]: spamd: server killed by SIGTERM, shutting down
Oct 20 00:01:52 spamd[7428]: zoom: able to use 1108/1110 'body_0' compiled rules (99.819%)
Oct 20 00:01:53 spamd[7428]: rules: meta test JMQ_CONGRAT has dependency 'KAM_RAPTOR_ALTERED' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_WARRANTY has dependency 'CBJ_GiveMeABreak' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_TIMEGEO has dependency 'KAM_GEO_STRING2' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_SETTING2 has dependency 'KAM_SETTING' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test HELO_DYNAMIC_DHCP has dependency 'HELO_STATIC_HOST' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test STOCK_PRICES has dependency 'SHORT_TERM_PRICE' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test NO_HEADERS_MESSAGE has dependency 'NO_RECEIVED' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test NO_HEADERS_MESSAGE has dependency 'NO_RELAYS' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test NO_HEADERS_MESSAGE has dependency 'MISSING_MID' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test BODY_EMPTY has dependency 'NO_RELAYS' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test HELO_DYNAMIC_HCC has dependency 'HELO_STATIC_HOST' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test FROM_PAYPAL_SPOOF has dependency 'NO_RELAYS' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_DISH2 has dependency 'KAM_DISH' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test PUMPDUMP has dependency 'PUMPDUMP_MULTI' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_FAKE_DELIVER has dependency 'KAM_RAPTOR_ALTERED' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_CARD has dependency 'KAM_RPTR_SUSPECT' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_GOODAOL has dependency 'KAM_BADAOL' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test HELO_MISC_IP has dependency 'HELO_DYNAMIC_DIALIN' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_LIVEURI2 has dependency 'KAM_PRODUCT' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_LIVEURI2 has dependency 'KAM_MSN_STRING' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_LIVEURI2 has dependency 'KAM_BADSWF' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_REFINEW2 has dependency 'KAM_REFINEW' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_REFINEW2 has dependency 'KAM_NEWNOTICE' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_NOTIFY2 has dependency 'KAM_IFRAME' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_REALLY_FAKE_DELIVER has dependency 'KAM_RPTR_PASSED' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_SEX06 has dependency 'KAM_MSN_STRING' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test HDRS_LCASE has dependency 'NO_RELAYS' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KB_FAKED_THE_BAT has dependency 'KB_DATE_CONTAINS_TAB' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test __SHORT_BODY_G_DRIVE_DYN has dependency 'FSL_HELO_NON_FQDN_1' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_INSURE2 has dependency 'CBJ_GiveMeABreak' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_AUTONEW2 has dependency 'KAM_NEWNOTICE' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_RE_PLUS has dependency 'KAM_RE' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_SENDGRID has dependency 'SPF_HELO_NONE' with a zero score
MANY SIMILAR LINES

Have a nice day.

cPanelLauren · Oct 23, 2020

Can you show a little prior to the start point there? Also, you can stop at the point spamd is killed, the startup logs aren't useful in this instance. Are you aware of the server resource usage status at this juncture? If it was a memory usage issue it would be noted in /var/log/messages just prior to the service being killed.

MindServer · Oct 23, 2020

Hi,

-100% secure that not is a Memory problem. In this server we have 128GB RAM and only 1 cPanel account (not did the migration yet).
-SIGTERM kills "smapd" one time every day or two days.
-More extended log:

KILL HOUR: Oct 20 00:01:51 spamd[736449]: spamd: server killed by SIGTERM, shutting down

/var/log/maillog -> you can see that repeat the same line many many many times:

REPEAT THIS LINES DOZENS OF TIMES

Oct 19 22:30:27 dovecot: lmtp(964134): Connect from local
Oct 19 22:30:27 dovecot: lmtp(964134): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 22:30:27 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=964153, secured, session=<gYAZ/AuyTNd/AAAB>
Oct 19 22:30:27 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<964153><gYAZ/AuyTNd/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 22:40:27 spamd[738530]: spamd: connection from localhost [::1]:45900 to port 783, fd 5
Oct 19 22:40:27 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<yTLcHwyygHJ/AAAB>
Oct 19 22:40:27 dovecot: lmtp(965887): Connect from local
Oct 19 22:40:27 dovecot: lmtp(965887): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 22:40:27 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=965900, secured, session=<G7bfHwyyItl/AAAB>
Oct 19 22:40:27 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<965900><G7bfHwyyItl/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 22:48:04 spamd[738530]: spamd: connection from localhost [::1]:46272 to port 783, fd 5
Oct 19 22:48:04 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<cZoVOwyy9HN/AAAB>
Oct 19 22:48:04 dovecot: lmtp(967791): Connect from local
Oct 19 22:48:04 dovecot: lmtp(967791): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 22:48:04 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=967804, secured, session=<GBkZOwyyltp/AAAB>
Oct 19 22:48:04 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<967804><GBkZOwyyltp/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 22:58:04 spamd[738530]: spamd: connection from localhost [::1]:46612 to port 783, fd 5
Oct 19 22:58:04 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<LO/bXgyySHV/AAAB>
Oct 19 22:58:04 dovecot: lmtp(969587): Connect from local
Oct 19 22:58:04 dovecot: lmtp(969587): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 22:58:04 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=969600, secured, session=<YXnfXgyy6tt/AAAB>
Oct 19 22:58:04 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<969600><YXnfXgyy6tt/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 23:08:04 spamd[738530]: spamd: connection from localhost [::1]:46892 to port 783, fd 5
Oct 19 23:08:04 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<qk6iggyyYHZ/AAAB>
Oct 19 23:08:04 dovecot: lmtp(971181): Connect from local
Oct 19 23:08:04 dovecot: lmtp(971181): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 23:08:04 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=971194, secured, session=<LdulggyyAt1/AAAB>
Oct 19 23:08:04 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<971194><LdulggyyAt1/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 23:18:04 spamd[738530]: spamd: connection from localhost [::1]:47220 to port 783, fd 5
Oct 19 23:18:04 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<0qJopgyyqHd/AAAB>
Oct 19 23:18:04 dovecot: lmtp(972792): Connect from local
Oct 19 23:18:04 dovecot: lmtp(972792): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 23:18:05 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=972811, secured, session=<3yNspgyySt5/AAAB>
Oct 19 23:18:05 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<972811><3yNspgyySt5/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 23:28:04 spamd[738530]: spamd: connection from localhost [::1]:47542 to port 783, fd 5
Oct 19 23:28:04 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<N/ouygyy6nh/AAAB>
Oct 19 23:28:05 dovecot: lmtp(974561): Connect from local
Oct 19 23:28:05 dovecot: lmtp(974561): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 23:28:05 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=974593, secured, session=<eosyygyyjN9/AAAB>
Oct 19 23:28:05 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<974593><eosyygyyjN9/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 23:38:05 spamd[738530]: spamd: connection from localhost [::1]:47852 to port 783, fd 5
Oct 19 23:38:05 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<cv307QyyIHp/AAAB>
Oct 19 23:38:05 dovecot: lmtp(976108): Connect from local
Oct 19 23:38:05 dovecot: lmtp(976108): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 23:38:05 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=976127, secured, session=<inX47QyywuB/AAAB>
Oct 19 23:38:05 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<976127><inX47QyywuB/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 23:48:05 spamd[738530]: spamd: connection from localhost [::1]:48164 to port 783, fd 5
Oct 19 23:48:05 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<rfu6EQ2yWHt/AAAB>
Oct 19 23:48:05 dovecot: lmtp(977628): Connect from local
Oct 19 23:48:05 dovecot: lmtp(977628): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 23:48:05 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=977647, secured, session=<BKC+EQ2y+uF/AAAB>
Oct 19 23:48:05 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<977647><BKC+EQ2y+uF/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 19 23:58:05 spamd[738530]: spamd: connection from localhost [::1]:48480 to port 783, fd 5
Oct 19 23:58:05 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<9jeBNQ2ylHx/AAAB>
Oct 19 23:58:05 dovecot: lmtp(979263): Connect from local
Oct 19 23:58:05 dovecot: lmtp(979263): Disconnect from local: Client has quit the connection (state=READY)
Oct 19 23:58:05 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=979276, secured, session=<R8mENQ2yNuN/AAAB>
Oct 19 23:58:05 dovecot: imap(__cpanel__service__auth__imap__pjzkx5s_jrr8xvuf)<979276><R8mENQ2yNuN/AAAB>: Logged out in=11, out=502, bytes=11/502
Oct 20 00:01:51 spamd[736449]: prefork: child states: II [... logline repeated 157 times]
Oct 20 00:01:51 spamd[736449]: spamd: server killed by SIGTERM, shutting down
Oct 20 00:01:52 spamd[7428]: zoom: able to use 1108/1110 'body_0' compiled rules (99.819%)
Oct 20 00:01:53 spamd[7428]: rules: meta test JMQ_CONGRAT has dependency 'KAM_RAPTOR_ALTERED' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_WARRANTY has dependency 'CBJ_GiveMeABreak' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_TIMEGEO has dependency 'KAM_GEO_STRING2' with a zero score
Oct 20 00:01:53 spamd[7428]: rules: meta test KAM_SETTING2 has dependency 'KAM_SETTING' with a zero score

Thank you very much. Have a nice day.

cPanelLauren · Oct 23, 2020

If you're not seeing a memory issue or anything of note occurring just before the shutdown and it's only happening every few days I don't think it's a concern. This is pretty standard behavior. Note the output from my own server:

Code:

[[email protected] includes]# grep "spamd: server killed by SIGTERM" /var/log/maillog
Oct 18 05:19:33 server spamd[9253]: spamd: server killed by SIGTERM, shutting down
Oct 19 05:21:16 server spamd[8434]: spamd: server killed by SIGTERM, shutting down
Oct 21 05:18:48 server spamd[11905]: spamd: server killed by SIGTERM, shutting down
Oct 21 11:59:38 server spamd[12092]: spamd: server killed by SIGTERM, shutting down
Oct 22 05:18:15 server spamd[7441]: spamd: server killed by SIGTERM, shutting down
Oct 23 05:19:03 server spamd[17060]: spamd: server killed by SIGTERM, shutting down
[[email protected] includes]# grep -i spam /var/log/messages
Oct 18 05:19:33 server systemd: Stopping Apache SpamAssassin™ deferral daemon...
Oct 18 05:19:34 server systemd: Stopped Apache SpamAssassin™ deferral daemon.
Oct 18 05:19:34 server systemd: Starting Apache SpamAssassin™ deferral daemon...
Oct 18 05:19:40 server systemd: Started Apache SpamAssassin™ deferral daemon.
Oct 19 05:21:16 server systemd: Stopping Apache SpamAssassin™ deferral daemon...
Oct 19 05:21:17 server systemd: Stopped Apache SpamAssassin™ deferral daemon.
Oct 19 05:21:17 server systemd: Starting Apache SpamAssassin™ deferral daemon...
Oct 19 05:21:22 server systemd: Started Apache SpamAssassin™ deferral daemon.
Oct 21 05:18:48 server systemd: Stopping Apache SpamAssassin™ deferral daemon...
Oct 21 05:18:50 server systemd: Stopped Apache SpamAssassin™ deferral daemon.
Oct 21 05:18:50 server systemd: Starting Apache SpamAssassin™ deferral daemon...
Oct 21 05:18:57 server systemd: Started Apache SpamAssassin™ deferral daemon.
Oct 21 11:59:38 server systemd: Stopping Apache SpamAssassin™ deferral daemon...
Oct 21 11:59:39 server systemd: Stopped Apache SpamAssassin™ deferral daemon.
Oct 21 11:59:39 server systemd: Starting Apache SpamAssassin™ deferral daemon...
Oct 21 11:59:45 server systemd: Started Apache SpamAssassin™ deferral daemon.
Oct 22 05:18:15 server systemd: Stopping Apache SpamAssassin™ deferral daemon...
Oct 22 05:18:18 server systemd: Stopped Apache SpamAssassin™ deferral daemon.
Oct 22 05:18:18 server systemd: Starting Apache SpamAssassin™ deferral daemon...
Oct 22 05:18:24 server systemd: Started Apache SpamAssassin™ deferral daemon.
Oct 23 05:19:03 server systemd: Stopping Apache SpamAssassin™ deferral daemon...
Oct 23 05:19:04 server systemd: Stopped Apache SpamAssassin™ deferral daemon.
Oct 23 05:19:04 server systemd: Starting Apache SpamAssassin™ deferral daemon...
Oct 23 05:19:09 server systemd: Started Apache SpamAssassin™ deferral daemon.

In this instance systemd is performing the restart which is evidenced by the log comparison.

MindServer · Oct 24, 2020

Thank you very much. I will contrast with other servers like you did and close this question.

Thank you again for your help. Have a nice day.

Thread starter	Similar threads	Forum	Replies	Date
A	spamd hung issue server was unresponsive	Email	3	Apr 1, 2017
M	spamd: server killed by SIGTERM, shutting down	Email	5	Dec 22, 2014
W	spamd not showing in Server Status » Service Status	Email	3	Dec 15, 2013
R	What are optimal setting for Spamd Startup Configuration on server?	Email	1	May 5, 2013
W	cpanel server unstable high cpu process and smtp/pop3/spamd problem	Email	1	Jun 12, 2012

Search

Search

spamd: server killed by SIGTERM, shutting down

MindServer

Well-Known Member

cPanelLauren

Product Owner II

MindServer

Well-Known Member

cPanelLauren

Product Owner II

MindServer

Well-Known Member

cPanelLauren

Product Owner II

MindServer

Well-Known Member

cPanelLauren

Product Owner II

MindServer

Well-Known Member

cPanelLauren

Product Owner II

MindServer

Well-Known Member

cPanelLauren

Product Owner II

MindServer

Well-Known Member

cPanelLauren

Product Owner II

MindServer

Well-Known Member