The service “spamd” appears to be down.

[seco]

Hi
every day since many months this notification comes to me from the server
The service “spamd” appears to be down.

and the service is recovered after that

the Service Check Method
The system’s command to check or to restart this service failed.

what i can do to solve this problem
thanks in advance.
WHM 58.0 (build 32)

 

[cPanelMichael]

Hello,

Could you let us know the specific output to /var/log/chkservd.log and /var/log/exim_mainlog when the spamd service is detected as down?

Thank you.

 

[polonski]

here's my log info

chkservd.log:

Service Check Started
Loading services .....cpanellogd....cpdavd....cpsrvd....crond....dnsadmin....httpd....imap....ipaliases....lmtp....mailman....mysql....named....nscd....pop....queueprocd....rsyslogd....spamd....sshd..Done
[2016-11-08 20:27:39 +1100] Disk check .... /var/tmp (/var/tmp) [7.37%] ... /tmp (/tmp) [7.37%] ... /boot (/boot) [15.43%] ... / (/) [65.95%] ... {status:eek:k} ... Done
[2016-11-08 20:27:39 +1100] OOM check ....Done
[2016-11-08 20:27:39 +1100] Service check ....sshd [[check command:+][socket connect:N/A]]...spamd [][check command:-][socket connect:N/A][fail count:152]Restarting spamd....
[notify:failed service:spamd]]...rsyslogd [[check command:+][socket connect:N/A]]...queueprocd [[check command:+][socket connect:N/A]]...pop [[check command:+][socket connect:+]]...p0f [[check command:N/A][socket connect:N/A]]...nscd [[check command:+][socket connect:N/A]]...named [[check command:+][socket connect:N/A]]...mysql [[check command:+][socket connect:N/A]]...mailman [[check command:+][socket connect:N/A]]...lmtp [[check command:+][socket connect:+]]...ipaliases [[check command:+][socket connect:N/A]]...imap [[socket_service_auth:1][check command:+][socket connect:+]]...httpd [[check command:N/A][socket connect:+]]...exim [[check command:N/A][socket connect:N/A]]...dnsadmin [[http_service_auth:1][check command:+][socket connect:+]]...crond [[check command:+][socket connect:N/A]]...cpsrvd [[http_service_auth:1][check command:N/A][socket connect:+]]...cpgreylistd [[check command:N/A][socket connect:N/A]]...cpdavd [[http_service_auth:1][check command:+][socket connect:+]]...cpanellogd [[check command:+][socket connect:N/A]]...Done
Service Check Finished

and exim_main

2016-11-08 20:27:41 cwd=/ 3 args: /usr/sbin/sendmail -odb -ti
2016-11-08 20:27:42 1c42gv-000C2v-W3 <= [email protected] U=root P=local S=43048 T="[vs-sub.host.fake.com] FAILED \342\233\224: spamd (43.250.250.200)" for [email protected]
2016-11-08 20:27:42 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1c42gv-000C2v-W3
2016-11-08 20:27:45 1c42gv-000C2v-W3 => [email protected] R=lookuphost T=remote_smtp H=aspmx.l.google.com [74.125.204.26] X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=yes C="250 2.0.0 OK 1478597263 w5si9261154pgj.87 - gsmtp"
2016-11-08 20:27:45 1c42gv-000C2v-W3 Completed

with some details faked

 

[cPanelMichael]

Hello,

Do you notice any additional output to /var/log/exim_mainlog before the times that SpamAssassin is detected as down?

Thank you.

 

[polonski]

Hello,

Do you notice any additional output to /var/log/exim_mainlog before the times that SpamAssassin is detected as down?

Thank you.

Thanks I found something like this . exim trying to send email to root ?

2016-11-05 17:07:18 cwd=/var/spool/exim 4 args: /usr/sbin/exim -odi -Mc 1c2u7F-0004rn-VZ
2016-11-05 17:07:20 1c2u7F-0004rn-VZ => env25446 <[email protected]> R=localuser T=dovecot_delivery C="250 2.0.0 <[email protected]> RjKnCBh3HVhySgAAGOffjA Saved"
2016-11-05 17:07:20 1c2u7F-0004rn-VZ Completed
2016-11-06 02:39:02 cwd=/root 9 args: /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root
2016-11-06 02:52:02 1c333e-00031Z-Bi <= [email protected] U=root P=local S=241689 T="Cron <[email protected]> /usr/local/cpanel/scripts/upcp --cron" for root
2016-11-06 02:52:02 cwd=/var/spool/exim 4 args: /usr/sbin/exim -odi -Mc 1c333e-00031Z-Bi
2016-11-06 02:52:02 1c333e-00031Z-Bi ** [email protected] R=localuser_root: root cannot accept local mail deliveries
2016-11-06 02:52:02 cwd=/var/spool/exim 8 args: /usr/sbin/exim -odi -t -oem -oi -f <> -E1c333e-00031Z-Bi
2016-11-06 02:52:03 1c33GE-0003nv-UF <= <> R=1c333e-00031Z-Bi U=mailnull P=local S=2191 T="Mail delivery failed: returning message to sender" for [email protected]
2016-11-06 02:52:03 cwd=/var/spool/exim 4 args: /usr/sbin/exim -odi -Mc 1c33GE-0003nv-UF
2016-11-06 02:52:03 1c33GE-0003nv-UF ** [email protected] R=localuser_root: root cannot accept local mail deliveries
2016-11-06 02:52:03 1c33GE-0003nv-UF Frozen (delivery error message)
2016-11-06 02:52:03 1c333e-00031Z-Bi Completed

Does that help?

 

[cPanelMichael]

Hello,

I don't see anything in the log output that suggests an issue with SpamAssassin. Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

Thank you.

 

[polonski]

Hi thanks for that.

The ticket id is 7945299

Many thanks!
Michal

 

[polonski]

Turns out I was not running exim which SpamAssasin was trying to use

Just had to turn off SpamAssasin:

WHM -> Service Configuration -> Service Manager, and disabled the Apache SpamAssassin™ service.

thanks to the cpanel support for speedy reply! you guys are awesome!

 

[cPanelMichael]

Hello,

I'm happy to see the issue is now resolved. Thank you for updating us with the outcome.