# DSPAM issue

## terryanan

HELP!!!

Recently my mail server often appear this log, who can tell me that what's wrong with my mail server, and how can I troubleshoot it?

Here is my server's maillog as below:

Sep  4 04:09:03 mail dspam[7323]: Got error -5 in response to message data: 354 End data with <CR><LF>.<CR><LF>

Sep  4 04:09:03 mail postfix/qmgr[12524]: 0749D53488C: from=<sales-sz@wintec.hk>, size=621796, nrcpt=1 (queue active)

Sep  4 04:09:03 mail postfix/qmgr[12524]: CC20C534836: from=<e-marketing.401472242.393983.0@mail.hsbc.com.hk>, size=34829, nrcpt=1 (queue active)

Sep  4 04:09:03 mail dspam[7323]: Got error -5 in response to message data: 354 End data with <CR><LF>.<CR><LF>

Sep  4 04:09:03 mail dspam[7323]: Got error -5 in response to message data: 354 End data with <CR><LF>.<CR><LF>

Sep  4 04:09:03 mail dspam[8103]: Client exited with error -5

Sep  4 04:09:03 mail amavis[15110]: (15110-07) (!)DSPAM stderr: 8103: [09/04/2011 04:09:03] Client exited with error -5\n

Sep  4 04:09:03 mail amavis[15110]: (15110-07) (!)checking with spam scanner DSPAM failed: DSPAM: error running program /usr/bin/dspam: exit 251

Sep  4 04:09:03 mail dspam[8106]: Client exited with error -5

Sep  4 04:09:03 mail amavis[3993]: (03993-12) (!)DSPAM stderr: 8106: [09/04/2011 04:09:03] Client exited with error -5\n

Sep  4 04:09:03 mail amavis[3993]: (03993-12) (!)checking with spam scanner DSPAM failed: DSPAM: error running program /usr/bin/dspam: exit 251

Sep  4 04:09:03 mail dspam[8107]: Client exited with error -5

Sep  4 04:09:03 mail amavis[3947]: (03947-16) (!)DSPAM stderr: 8107: [09/04/2011 04:09:03] Client exited with error -5\n

Sep  4 04:09:03 mail amavis[3947]: (03947-16) (!)checking with spam scanner DSPAM failed: DSPAM: error running program /usr/bin/dspam: exit 251

Sep  4 04:09:03 mail amavis[15110]: (15110-07) (!!)TROUBLE in check_mail: spam_scan FAILED: DSPAM failed: DSPAM: error running program /usr/bin/dspam: exit 251 at (eval 102) line 109, <GEN71> line 1067.

Sep  4 04:09:03 mail dspam[7323]: Delivery failed completely

Sep  4 04:09:03 mail amavis[15110]: (15110-07) (!)PRESERVING EVIDENCE in /var/spool/vscan/tmp/amavis-20110904T033332-15110

Sep  4 04:09:03 mail amavis[3947]: (03947-16) (!!)TROUBLE in check_mail: spam_scan FAILED: DSPAM failed: DSPAM: error running program /usr/bin/dspam: exit 251 at (eval 102) line 109, <GEN196> line 3943.

Sep  4 04:09:03 mail dspam[7323]: Delivery failed completely

Sep  4 04:09:03 mail amavis[3947]: (03947-16) (!)PRESERVING EVIDENCE in /var/spool/vscan/tmp/amavis-20110904T010403-03947

Sep  4 04:09:03 mail amavis[3993]: (03993-12) (!!)TROUBLE in check_mail: spam_scan FAILED: DSPAM failed: DSPAM: error running program /usr/bin/dspam: exit 251 at (eval 102) line 109, <GEN122> line 7699.

Sep  4 04:09:03 mail dspam[7323]: Delivery failed completely

Sep  4 04:09:03 mail amavis[3993]: (03993-12) (!)PRESERVING EVIDENCE in /var/spool/vscan/tmp/amavis-20110903T195403-03993

Sep  4 04:09:03 mail postfix/lmtp[8094]: C6ED753480F: to=<it.metal@mydomain.com.cn>, relay=127.0.0.1[127.0.0.1]:10028, delay=53608, delays=53307/0.01/0.04/301, dsn=4.3.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 421 4.3.0 <it.metal@mydomain.com.cn> Deferred: 354 End data with <CR><LF>.<CR><LF> (in reply to end of DATA command))

Sep  4 04:09:03 mail postfix/lmtp[8096]: CAA59534857: to=<debbie.metal@mydomain.com.cn>, relay=127.0.0.1[127.0.0.1]:10028, delay=81813, delays=81512/0.01/0.04/301, dsn=4.3.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 421 4.3.0 <debbie.metal@mydomain.com.cn> Deferred: 354 End data with <CR><LF>.<CR><LF> (in reply to end of DATA command))

Sep  4 04:09:03 mail postfix/lmtp[8093]: 06297534883: to=<lawrencekwok@mydomain.com.cn>, relay=127.0.0.1[127.0.0.1]:10028, delay=65088, delays=64787/0/0.04/301, dsn=4.3.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 421 4.3.0 <lawrencekwok@mydomain.com.cn> Deferred: 354 End data with <CR><LF>.<CR><LF> (in reply to end of DATA command))

----------

## magic919

Try running dspam command by hand and look for errors. Would be worth mentioning version and posting configuration for DSPAM.

----------

## terryanan

 *magic919 wrote:*   

> Try running dspam command by hand and look for errors. Would be worth mentioning version and posting configuration for DSPAM.

 

DSPAM Version:

[root@mail ~]# dspam --version

DSPAM Anti-Spam Suite 3.8.0 (agent/library)

Copyright (c) 2002-2006 Jonathan A. Zdziarski

http://dspam.nuclearelephant.com

DSPAM may be copied only under the terms of the GNU General Public License,

a copy of which can be found with the DSPAM distribution kit.

Configuration parameters: --build=i686-redhat-linux-gnu --host=i686-redhat-linux-gnu --target=i386-redhat-linux-gnu --program-prefix= --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/usr/com --mandir=/usr/share/man --infodir=/usr/share/info --sysconfdir=/etc/dspam --with-dspam-home=/var/spool/dspam --with-logdir=/var/log/dspam --enable-shared --enable-static --enable-daemon --enable-external-lookup --enable-clamav --enable-debug --enable-syslog --enable-preferences-extension --enable-long-usernames --enable-large-scale --enable-virtual-users --disable-trusted-user-security --with-storage-driver=hash_drv,mysql_drv,pgsql_drv --with-mysql-includes=/usr/include/mysql --with-mysql-libraries=/usr/lib/mysql

DSPAM.conf  as below：

# XXX - dspam.conf

Home /var/spool/dspam

StorageDriver /usr/lib/libmysql_drv.so

TrustedDeliveryAgent "/usr/sbin/sendmail"

DeliveryHost        127.0.0.1

DeliveryPort        10024

DeliveryIdent       localhost

DeliveryProto       SMTP

Trust root

Trust mail

Trust mailnull

Trust smmsp

Trust daemon

Trust dspam

Trust vuser

#Debug *

#DebugOpt process spam fp

TrainingMode teft

TestConditionalTraining on

Feature whitelist

"dspam.conf" 77L, 1929C                                       1,1           Top

# XXX - dspam.conf

Home /var/spool/dspam

StorageDriver /usr/lib/libmysql_drv.so

TrustedDeliveryAgent "/usr/sbin/sendmail"

DeliveryHost        127.0.0.1

DeliveryPort        10024

DeliveryIdent       localhost

DeliveryProto       SMTP

Trust root

Trust mail

Trust mailnull

Trust smmsp

Trust daemon

Trust dspam

Trust vuser

#Debug *

#DebugOpt process spam fp

TrainingMode teft

TestConditionalTraining on

Feature whitelist

Algorithm graham burton

Tokenizer chain

PValue bcr

WebStats on

Preference "signatureLocation=headers"

Preference "spamAction=deliver"

Preference "showFactors=off"

AllowOverride trainingMode

AllowOverride spamAction spamSubject

AllowOverride statisticalSedation

AllowOverride enableBNR

AllowOverride enableWhitelist

AllowOverride signatureLocation

AllowOverride showFactors

AllowOverride optIn optOut

AllowOverride whitelistThreshold

MySQLServer     /var/lib/mysql/mysql.sock

MySQLUser               dspam

MySQLPass               dspam

MySQLDb                 dspam

MySQLCompress           true

Notifications   off

PurgeSignatures 14          # Stale signatures

PurgeNeutral    90          # Tokens with neutralish probabilities

PurgeUnused     90          # Unused tokens

PurgeHapaxes    30          # Tokens with less than 5 hits (hapaxes)

PurgeHits1S     15          # Tokens with only 1 spam hit

PurgeHits1I     15          # Tokens with only 1 innocent hit

LocalMX 127.0.0.1

SystemLog on

UserLog   on

Opt out

ServerPort              10028

ServerQueueSize 32

ServerPID               /var/run/dspamd/dspamd.pid

ServerMode              auto

ServerPass.Relay1       "secret"

#ServerParameters        "--deliver=innocent,spam --user extmail -d %u"

ServerParameters        "--user extmail --deliver=innocent"

ServerIdent             "localhost.localdomain"

ClientHost      127.0.0.1

ClientPort      10028

ClientIdent     "secret@Relay1"

ProcessorURLContext on

ProcessorBias on

MySQLUIDInSignature    on

----------

## magic919

So what happens when you run it by hand?

----------

## terryanan

 *magic919 wrote:*   

> So what happens when you run it by hand?

 

[root@mail ~]# service dspamd restart

Shutting down the DSPAM server (dspamd):                   [  OK  ]

Starting the DSPAM server (dspamd):                        [  OK  ]

[root@mail ~]# tail -f /var/log/dspam/dspamd.log

22758: [09/13/2011 08:34:30] Daemon terminating on signal 15

22758: [09/13/2011 08:34:30] received signal. waiting for processing threads to exit.

22758: [09/13/2011 08:34:30] daemon is down.

22758: [09/13/2011 08:34:30] Daemon process exiting

22812: [09/13/2011 08:34:33] Daemon process starting

----------

