The service “spamd” appears to be down.

seco

Member
Mar 18, 2015
6
0
1
Egypt
cPanel Access Level
Root Administrator
Hi
every day since many months this notification comes to me from the server
The service “spamd” appears to be down.

and the service is recovered after that

the Service Check Method
The system’s command to check or to restart this service failed.

what i can do to solve this problem
thanks in advance.
WHM 58.0 (build 32)
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,883
2,256
463
Hello,

Could you let us know the specific output to /var/log/chkservd.log and /var/log/exim_mainlog when the spamd service is detected as down?

Thank you.
 
  • Like
Reactions: polonski

polonski

Registered
Nov 8, 2016
4
1
3
australia
cPanel Access Level
Root Administrator
here's my log info

chkservd.log:

Code:
Service Check Started
Loading services .....cpanellogd....cpdavd....cpsrvd....crond....dnsadmin....httpd....imap....ipaliases....lmtp....mailman....mysql....named....nscd....pop....queueprocd....rsyslogd....spamd....sshd..Done
[2016-11-08 20:27:39 +1100] Disk check .... /var/tmp (/var/tmp) [7.37%] ... /tmp (/tmp) [7.37%] ... /boot (/boot) [15.43%] ... / (/) [65.95%] ... {status:eek:k} ... Done
[2016-11-08 20:27:39 +1100] OOM check ....Done
[2016-11-08 20:27:39 +1100] Service check ....sshd [[check command:+][socket connect:N/A]]...spamd [][check command:-][socket connect:N/A][fail count:152]Restarting spamd....
[notify:failed service:spamd]]...rsyslogd [[check command:+][socket connect:N/A]]...queueprocd [[check command:+][socket connect:N/A]]...pop [[check command:+][socket connect:+]]...p0f [[check command:N/A][socket connect:N/A]]...nscd [[check command:+][socket connect:N/A]]...named [[check command:+][socket connect:N/A]]...mysql [[check command:+][socket connect:N/A]]...mailman [[check command:+][socket connect:N/A]]...lmtp [[check command:+][socket connect:+]]...ipaliases [[check command:+][socket connect:N/A]]...imap [[socket_service_auth:1][check command:+][socket connect:+]]...httpd [[check command:N/A][socket connect:+]]...exim [[check command:N/A][socket connect:N/A]]...dnsadmin [[http_service_auth:1][check command:+][socket connect:+]]...crond [[check command:+][socket connect:N/A]]...cpsrvd [[http_service_auth:1][check command:N/A][socket connect:+]]...cpgreylistd [[check command:N/A][socket connect:N/A]]...cpdavd [[http_service_auth:1][check command:+][socket connect:+]]...cpanellogd [[check command:+][socket connect:N/A]]...Done
Service Check Finished

and exim_main

2016-11-08 20:27:41 cwd=/ 3 args: /usr/sbin/sendmail -odb -ti
2016-11-08 20:27:42 1c42gv-000C2v-W3 <= [email protected] U=root P=local S=43048 T="[vs-sub.host.fake.com] FAILED \342\233\224: spamd (43.250.250.200)" for [email protected]
2016-11-08 20:27:42 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1c42gv-000C2v-W3
2016-11-08 20:27:45 1c42gv-000C2v-W3 => [email protected] R=lookuphost T=remote_smtp H=aspmx.l.google.com [74.125.204.26] X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=yes C="250 2.0.0 OK 1478597263 w5si9261154pgj.87 - gsmtp"
2016-11-08 20:27:45 1c42gv-000C2v-W3 Completed

with some details faked
 
Last edited by a moderator:
  • Like
Reactions: seco

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,883
2,256
463
Hello,

Do you notice any additional output to /var/log/exim_mainlog before the times that SpamAssassin is detected as down?

Thank you.
 
  • Like
Reactions: polonski

polonski

Registered
Nov 8, 2016
4
1
3
australia
cPanel Access Level
Root Administrator
Hello,

Do you notice any additional output to /var/log/exim_mainlog before the times that SpamAssassin is detected as down?

Thank you.
Thanks I found something like this . exim trying to send email to root ?

Code:
2016-11-05 17:07:18 cwd=/var/spool/exim 4 args: /usr/sbin/exim -odi -Mc 1c2u7F-0004rn-VZ
2016-11-05 17:07:20 1c2u7F-0004rn-VZ => env25446 <[email protected]> R=localuser T=dovecot_delivery C="250 2.0.0 <[email protected]> RjKnCBh3HVhySgAAGOffjA Saved"
2016-11-05 17:07:20 1c2u7F-0004rn-VZ Completed
2016-11-06 02:39:02 cwd=/root 9 args: /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root
2016-11-06 02:52:02 1c333e-00031Z-Bi <= [email protected] U=root P=local S=241689 T="Cron <[email protected]> /usr/local/cpanel/scripts/upcp --cron" for root
2016-11-06 02:52:02 cwd=/var/spool/exim 4 args: /usr/sbin/exim -odi -Mc 1c333e-00031Z-Bi
2016-11-06 02:52:02 1c333e-00031Z-Bi ** [email protected] R=localuser_root: root cannot accept local mail deliveries
2016-11-06 02:52:02 cwd=/var/spool/exim 8 args: /usr/sbin/exim -odi -t -oem -oi -f <> -E1c333e-00031Z-Bi
2016-11-06 02:52:03 1c33GE-0003nv-UF <= <> R=1c333e-00031Z-Bi U=mailnull P=local S=2191 T="Mail delivery failed: returning message to sender" for [email protected]
2016-11-06 02:52:03 cwd=/var/spool/exim 4 args: /usr/sbin/exim -odi -Mc 1c33GE-0003nv-UF
2016-11-06 02:52:03 1c33GE-0003nv-UF ** [email protected] R=localuser_root: root cannot accept local mail deliveries
2016-11-06 02:52:03 1c33GE-0003nv-UF Frozen (delivery error message)
2016-11-06 02:52:03 1c333e-00031Z-Bi Completed
Does that help?
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,883
2,256
463
Hello,

I don't see anything in the log output that suggests an issue with SpamAssassin. Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

Thank you.
 
  • Like
Reactions: seco and polonski

polonski

Registered
Nov 8, 2016
4
1
3
australia
cPanel Access Level
Root Administrator
Turns out I was not running exim which SpamAssasin was trying to use

Just had to turn off SpamAssasin:

WHM -> Service Configuration -> Service Manager, and disabled the Apache SpamAssassin™ service.
thanks to the cpanel support for speedy reply! you guys are awesome!
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,883
2,256
463
Hello,

I'm happy to see the issue is now resolved. Thank you for updating us with the outcome.