From martin.hierling at fh-luh.de Thu Mar 1 09:35:38 2007 From: martin.hierling at fh-luh.de (Martin Hierling) Date: Thu, 1 Mar 2007 18:35:38 +0100 Subject: [SA-exim] sig 11 problem Message-ID: <20070301173538.GA27604@cc.fh-luh.de> Hi, i have a bunch of sig11 message in my exim log. 2007-03-01 01:01:49 1HMYk1-0002om-0h local_scan() function crashed with signal 11 - message temporarily rejected (size 1021) 2007-03-01 02:04:42 1HMZir-0002uA-RE local_scan() function crashed with signal 11 - message temporarily rejected (size 2311) 2007-03-01 05:37:32 1HMd2o-0003Ca-Rc local_scan() function crashed with signal 11 - message temporarily rejected (size 28221) Any suggestion how to track this down? Setting SAEximDebug to some higher level? I have sniffed some smtp traffic while this happens. It seems to be all spam that triggers the sig 11, so it is not so important. I have attached 2 smtp session logs. Any ideas? What kind of data do you need (or i) to debug this? regards Martin -- ---------------------------------------------------------------- Will the information superhighway have any rest stops? ---------------------------------------------------------------- -------------- next part -------------- A non-text attachment was scrubbed... Name: smtp1_sig11.dat Type: chemical/x-mopac-input Size: 3959 bytes Desc: not available Url : http://lists.merlins.org/archives/sa-exim/attachments/20070301/39e606a9/attachment.dat -------------- next part -------------- A non-text attachment was scrubbed... Name: smtp2_sig11.dat Type: chemical/x-mopac-input Size: 2761 bytes Desc: not available Url : http://lists.merlins.org/archives/sa-exim/attachments/20070301/39e606a9/attachment-0001.dat From marc at merlins.org Thu Mar 1 10:37:01 2007 From: marc at merlins.org (Marc MERLIN) Date: Thu, 1 Mar 2007 10:37:01 -0800 Subject: [SA-exim] sig 11 problem In-Reply-To: <20070301173538.GA27604@cc.fh-luh.de> References: <20070301173538.GA27604@cc.fh-luh.de> Message-ID: <20070301183701.GD8082@merlins.org> On Thu, Mar 01, 2007 at 06:35:38PM +0100, Martin Hierling wrote: > Hi, > > i have a bunch of sig11 message in my exim log. So, does that happen for all mails, or just some? Did you build your own sa-exim? did you use a package? What platform/architecture are you on? Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ From marc at merlins.org Thu Mar 1 23:21:47 2007 From: marc at merlins.org (Marc MERLIN) Date: Thu, 1 Mar 2007 23:21:47 -0800 Subject: [SA-exim] sig 11 problem In-Reply-To: <20070302065222.GA1648@cc.fh-luh.de> References: <20070301173538.GA27604@cc.fh-luh.de> <20070301183701.GD8082@merlins.org> <20070302065222.GA1648@cc.fh-luh.de> Message-ID: <20070302072147.GA3606@merlins.org> On Fri, Mar 02, 2007 at 07:52:22AM +0100, Martin Hierling wrote: > Hi Marc, > > > > i have a bunch of sig11 message in my exim log. > > > > So, does that happen for all mails, or just some? > > No, only just some, about 8%. > > > Did you build your own sa-exim? did you use a package? > i am using the sa-exim ebuld for gentoo. > http://bugs.gentoo.org/show_bug.cgi?id=47106 > > > What platform/architecture are you on? > > Gentoo, x86 inside a Xen DomU, kernel 2.6.16.29, gcc-4.1.1, exim-4.62 Ok. Can you enable coredumps and run bt against the core to see where the code died? Or are the last sa-exim log lines before it dies always the same (at debug level 10). If so, what are they? Thanks Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ From MCG at mpsistemas.es Thu Mar 1 23:23:27 2007 From: MCG at mpsistemas.es (MANUEL CANSECO GARCIA) Date: Fri, 02 Mar 2007 08:23:27 +0100 Subject: [SA-exim] SA-Exim Digest, Vol 93, Issue 1 Message-ID: **** Mensaje Automatico *** Este usuario no se encuentra operativo, para cualquier asunto le ruego se pongan en contacto con Leandro Gayango lgg at mpsistemas.es *************************************************************************************** >>> sa-exim 03/02/07 08:21 >>> Send SA-Exim mailing list submissions to sa-exim at lists.merlins.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.merlins.org/lists/listinfo/sa-exim or, via email, send a message with subject or body 'help' to sa-exim-request at lists.merlins.org You can reach the person managing the list at sa-exim-owner at lists.merlins.org When replying, please edit your Subject line so it is more specific than "Re: Contents of SA-Exim digest..." Today's Topics: 1. Re: undefined vars in Greylisting.pm (Marc MERLIN) 2. Greylisting skipped due to bad header (Jamie Neil) 3. Inodes being eaten by tuplets/ and SA* log directories (Matt Bostock) 4. Re: Inodes being eaten by tuplets/ and SA* log directories (Marc MERLIN) 5. Multiple SAspamcHost's? Possible Feature Request (Rocky Olsen) 6. sig 11 problem (Martin Hierling) 7. Re: sig 11 problem (Marc MERLIN) 8. Re: sig 11 problem (Marc MERLIN) ---------------------------------------------------------------------- Message: 1 Date: Thu, 8 Feb 2007 08:37:50 -0800 From: Marc MERLIN Subject: Re: [SA-exim] undefined vars in Greylisting.pm To: Mike Pellatt Cc: sa-exim at lists.merlins.org Message-ID: <20070208163750.GK4314 at merlins.org> Content-Type: text/plain; charset=iso-8859-1 On Thu, Feb 08, 2007 at 04:12:25PM +0000, Mike Pellatt wrote: > > On 08 February 2007 15:12, Marc MERLIN [mailto:marc at merlins.org] wrote: > > On Thu, Feb 08, 2007 at 09:25:03AM +0100, Andreas V?gele wrote: > > > > I still don't get how SA-Exim can ever be the right tool for the > job > > > > as far as fetchmail is concerned. It can be made to work, but I'm > > > > not sure why? :) > > > > > > It doesn't make sense to use SA-Exim if fetchmail is the only means > of > > > retrieving mail. But if you would like to greylist SMTP connections > > > > and also have to use fetchmail SA-Exim is a good choice. > > > > That's true. And you must be the only person who does this :) > > > > No, he isn't :-) Ok, you guys win :) Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ ------------------------------ Message: 2 Date: Thu, 22 Feb 2007 18:18:04 +0000 From: Jamie Neil Subject: [SA-exim] Greylisting skipped due to bad header To: sa-exim at lists.merlins.org Message-ID: <45DDDE5C.2090006 at versado.net> Content-Type: text/plain; charset=ISO-8859-1 Hi, I've noticed a problem with greylisting recently where some messages are continually temp rejected because the greylisting check is being skipped. The affected messages _all_ seem to be legitimate NDRs from Hotmail as far as I can tell. The reason that they are skipped is that the "From" header has some bad characters in front of it, which causes the greylisting code to fail (because it can't find the X-SA-Connect-IP header). This is what the header looks like (personal info changed): ---- Received: from [65.54.246.99] (helo=bay0-omc1-s27.bay0.hotmail.com) by hera.versado.net with esmtp (Exim 4.50) id 1HKHaa-0001C7-79 for xxxx at xxxx.com; Thu, 22 Feb 2007 17:18:40 +0000 Received: from BAY124-W31 ([207.46.11.194]) by bay0-omc1-s27.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Wed, 21 Feb 2007 11:12:51 -0800 Message-ID: From: <> Bcc: X-OriginalArrivalTime: 21 Feb 2007 19:12:51.0089 (UTC) FILETIME=[47EFD010:01C755EC] Date: 21 Feb 2007 11:12:51 -0800 ???From: postmaster at mail.hotmail.com To: xxxx at xxxx.com Date: Wed, 21 Feb 2007 11:12:50 GMT MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="9B095B5ADSN=_49712A76E52946209FB33E26D41?WOM1.labinte" X-DSNContext: 7ce717b1 - 1196 - 00000002 - 00000000 X-SA-Exim-Connect-IP: 65.54.246.99 X-SA-Exim-Rcpt-To: xxxx at xxxx.com X-SA-Exim-Mail-From: X-Spam-Flag: YES ---- It's really just an irritation rather that a major problem because we're only seeing a handful of messages a week like this, and eventually the Hotmail servers will give up, but I see them in my log reports every day and they bug me. :) Has anyone else seen this problem? Is there a fix/work around? -- Jamie Neil | | 0870 7777 454 Versado I.T. Services Ltd. | http://versado.net/ | 0845 450 1254 ------------------------------ Message: 3 Date: Mon, 26 Feb 2007 1:23:35 +0000 From: Matt Bostock Subject: [SA-exim] Inodes being eaten by tuplets/ and SA* log directories To: sa-exim at lists.merlins.org Message-ID: Content-Type: text/plain; charset="UTF-8" Hey all, Just a suggestion: could a note be put in the documentation about the greylisting tuplets and their possible effect on inodes? I have no quibbles with the way tuplets or stored, but having never before run out of inodes before, it was never something I really thought about until I had none left :-) I'd forgotten to install the greylist-clean script in my crontab and so had thousands of tuplets. The /var/spool/exim/SA* directories that store copies of rejected/teergrubbed/etc mail also have a (somewhat lesser) impact on inodes. On a more positive note, since I've been using SA-Exim the spam rate for me and my users has dropped by about 80%. I've just installed the FuzzyOCR plugin for SA too which is working really nicely :-) Thanks for all of your hard work Marc, Matt ------------------------------ Message: 4 Date: Sun, 25 Feb 2007 17:48:01 -0800 From: Marc MERLIN Subject: Re: [SA-exim] Inodes being eaten by tuplets/ and SA* log directories To: Matt Bostock Cc: sa-exim at lists.merlins.org Message-ID: <20070226014801.GJ19547 at merlins.org> Content-Type: text/plain; charset=us-ascii On Mon, Feb 26, 2007 at 01:23:35AM +0000, Matt Bostock wrote: > Hey all, > > Just a suggestion: could a note be put in the documentation about the greylisting tuplets and their possible effect on inodes? README.greylisting says: - every x time (like 4 hours or two days), remove all greylist entries that only saw one mail (i.e. still greylisted, not whitelisted yet). This is done with a find cron job (...) Then, setup a cron job to delete tuplets that are older than 14 days for whitelisted entries, and 2 days for greylisted entries (or whatever values you fancy). (...) FILE SETUP ---------- You should install greylistclean.cron in /etc/cron.d/ on your system to call greylistclean and clean up greylisted entries and whitelisted entries that haven't been used in a while. You can optionally modify it to tweak the cleanup times. Note that you need to tweak greylistclean.cron to match the user spamd runs as if you aren't using the recommended --username=nobody Did that not come in the documentation with the sa-exim you got? Or did you use a package that wasn't setup properly to do this by default? Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ ------------------------------ Message: 5 Date: Wed, 28 Feb 2007 15:33:24 -0700 From: Rocky Olsen Subject: [SA-exim] Multiple SAspamcHost's? Possible Feature Request To: sa-exim at lists.merlins.org Message-ID: <20070228223324.GA26881 at mindphone.org> Content-Type: text/plain; charset=us-ascii I've searched through most of the archives and haven't been able to find an answer to this question. I'm wondering if it's been considered having the configuration value of SAspamcHost take multiple host names in csv format? and in doing so have it also pass the -H flag to spamc when it makes the execl call to provide some sort of load balancing. 'spamc -d host1,host2 -H' I tested this earlier today using 'SAspamcHost host1,host2' and it resulted in a configuration error. We are moving to having large backend spamscanning machines with light edge mta's. Our other options are using lvs or some other load balancer, but wanted to check here first. Thanks in advance -Rocky -- ______________________________________________________________________ what's with today, today? Email: rocky at mindphone.org ------------------------------ Message: 6 Date: Thu, 1 Mar 2007 18:35:38 +0100 From: Martin Hierling Subject: [SA-exim] sig 11 problem To: sa-exim at lists.merlins.org Message-ID: <20070301173538.GA27604 at cc.fh-luh.de> Content-Type: text/plain; charset="us-ascii" Hi, i have a bunch of sig11 message in my exim log. 2007-03-01 01:01:49 1HMYk1-0002om-0h local_scan() function crashed with signal 11 - message temporarily rejected (size 1021) 2007-03-01 02:04:42 1HMZir-0002uA-RE local_scan() function crashed with signal 11 - message temporarily rejected (size 2311) 2007-03-01 05:37:32 1HMd2o-0003Ca-Rc local_scan() function crashed with signal 11 - message temporarily rejected (size 28221) Any suggestion how to track this down? Setting SAEximDebug to some higher level? I have sniffed some smtp traffic while this happens. It seems to be all spam that triggers the sig 11, so it is not so important. I have attached 2 smtp session logs. Any ideas? What kind of data do you need (or i) to debug this? regards Martin -- ---------------------------------------------------------------- Will the information superhighway have any rest stops? ---------------------------------------------------------------- -------------- next part -------------- A non-text attachment was scrubbed... Name: smtp1_sig11.dat Type: chemical/x-mopac-input Size: 3959 bytes Desc: not available Url : http://lists.merlins.org/archives/sa-exim/attachments/20070301/39e606a9/attachment-0002.dat -------------- next part -------------- A non-text attachment was scrubbed... Name: smtp2_sig11.dat Type: chemical/x-mopac-input Size: 2761 bytes Desc: not available Url : http://lists.merlins.org/archives/sa-exim/attachments/20070301/39e606a9/attachment-0003.dat ------------------------------ Message: 7 Date: Thu, 1 Mar 2007 10:37:01 -0800 From: Marc MERLIN Subject: Re: [SA-exim] sig 11 problem To: Martin Hierling Cc: sa-exim at lists.merlins.org Message-ID: <20070301183701.GD8082 at merlins.org> Content-Type: text/plain; charset=us-ascii On Thu, Mar 01, 2007 at 06:35:38PM +0100, Martin Hierling wrote: > Hi, > > i have a bunch of sig11 message in my exim log. So, does that happen for all mails, or just some? Did you build your own sa-exim? did you use a package? What platform/architecture are you on? Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ ------------------------------ Message: 8 Date: Thu, 1 Mar 2007 23:21:47 -0800 From: Marc MERLIN Subject: Re: [SA-exim] sig 11 problem To: Martin Hierling Cc: sa-exim at lists.merlins.org Message-ID: <20070302072147.GA3606 at merlins.org> Content-Type: text/plain; charset=us-ascii On Fri, Mar 02, 2007 at 07:52:22AM +0100, Martin Hierling wrote: > Hi Marc, > > > > i have a bunch of sig11 message in my exim log. > > > > So, does that happen for all mails, or just some? > > No, only just some, about 8%. > > > Did you build your own sa-exim? did you use a package? > i am using the sa-exim ebuld for gentoo. > http://bugs.gentoo.org/show_bug.cgi?id=47106 > > > What platform/architecture are you on? > > Gentoo, x86 inside a Xen DomU, kernel 2.6.16.29, gcc-4.1.1, exim-4.62 Ok. Can you enable coredumps and run bt against the core to see where the code died? Or are the last sa-exim log lines before it dies always the same (at debug level 10). If so, what are they? Thanks Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ ------------------------------ _______________________________________________ SA-Exim mailing list SA-Exim at lists.merlins.org http://lists.merlins.org/lists/listinfo/sa-exim End of SA-Exim Digest, Vol 93, Issue 1 ************************************** From marc at merlins.org Sat Mar 3 07:16:40 2007 From: marc at merlins.org (Marc MERLIN) Date: Sat, 3 Mar 2007 07:16:40 -0800 Subject: [SA-exim] Multiple SAspamcHost's? Possible Feature Request In-Reply-To: <20070228223324.GA26881@mindphone.org> References: <20070228223324.GA26881@mindphone.org> Message-ID: <20070303151640.GC7366@merlins.org> On Wed, Feb 28, 2007 at 03:33:24PM -0700, Rocky Olsen wrote: > I've searched through most of the archives and haven't been able to find an > answer to this question. I'm wondering if it's been considered having the > configuration value of SAspamcHost take multiple host names in csv format? > and in doing so have it also pass the -H flag to spamc when it makes the > execl call to provide some sort of load balancing. 'spamc -d host1,host2 > -H' > > I tested this earlier today using 'SAspamcHost host1,host2' and it resulted > in a configuration error. We are moving to having large backend > spamscanning machines with light edge mta's. Our other options are using > lvs or some other load balancer, but wanted to check here first. I think it ought to work, what kind of configuration error are you getting? I set SAspamcHost: localhost,127.0.0.2 and I'm not getting any errors 2007-03-03 07:14:52 1HNVwi-0002Qh-Io SA: Debug4: config read SAspamcHost = localhost,127.0.0.2 Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ From marc at merlins.org Wed Mar 7 07:27:13 2007 From: marc at merlins.org (Marc MERLIN) Date: Wed, 7 Mar 2007 07:27:13 -0800 Subject: [SA-exim] Thanks for sa-exim, and a feature for the wishlist In-Reply-To: <200703071329.08616.ediaz@ultreia.es> References: <200703071329.08616.ediaz@ultreia.es> Message-ID: <20070307152713.GC12361@merlins.org> [replying to the sa-exim list] On Wed, Mar 07, 2007 at 01:29:08PM +0100, Eduardo Diaz Comellas wrote: > Hi Marc, > > I am a very happy user of sa-exim, and would want to thank you for this > exceptional piece of software. It really does spam fighting easier (as you > already know, of course). Thanks. > I have a few questions and a feature for the wishlist. Are you still > developing sa-exim? I noticed that there are no new releases since Jan. 2006, > and I don't know if this means that the project is stalled or that there are > no bugs or feature requests. I noticed that sa-exim appears as an sponsored > link at google, which makes me think that you still have interest on it... I have that google link as a test, because I work at google :) I'm not after feature creep, sa-exim does everything I need, and almost everything other people need, so I'm not spending a lot of time for it, but I still provide the support I can for sa-exim, and gather patches and suggestions for when I have/take time to make a new release. > My feature request is to be able to control the headers generated and the > report of spamassassin. Lasts versions of exim include an spamassassin > connector which allows to customize the headers generated while scanning the > mail. I would love to have this feature in sa-exim. That's the first time someone asks for this. For now, it's not hard to do by adding/copying a few lines of C code in sa-exim.c, but indeed not in the conf file. Adding the option to add other random headers acts a fair amount of complexity to the parsing code. If I get other requests for that, I might add it in the future, or I'll take patches too :) Another much simpler option is I can also add/hardcode a few other SA headers that people might want. What SA headers would you like? Cheers Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ From holmgren at lysator.liu.se Wed Mar 7 07:50:44 2007 From: holmgren at lysator.liu.se (Magnus Holmgren) Date: Wed, 7 Mar 2007 16:50:44 +0100 Subject: [SA-exim] Thanks for sa-exim, and a feature for the wishlist In-Reply-To: <20070307152713.GC12361@merlins.org> References: <200703071329.08616.ediaz@ultreia.es> <20070307152713.GC12361@merlins.org> Message-ID: <200703071650.47441@proffe.kibibyte.se> > On Wed, Mar 07, 2007 at 01:29:08PM +0100, Eduardo Diaz Comellas wrote: > > My feature request is to be able to control the headers generated and the > > report of spamassassin. Lasts versions of exim include an spamassassin > > connector which allows to customize the headers generated while scanning > > the mail. I would love to have this feature in sa-exim. What kind of headers? One can add various headers from SpamAssassin, and all those (that beging with X-Spam-) are added back by SA-Exim. -- Magnus Holmgren holmgren at lysator.liu.se (No Cc of list mail needed, thanks) -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: not available Url : http://lists.merlins.org/archives/sa-exim/attachments/20070307/8ba3a718/attachment.pgp From marc at merlins.org Wed Mar 7 08:28:23 2007 From: marc at merlins.org (Marc MERLIN) Date: Wed, 7 Mar 2007 08:28:23 -0800 Subject: [SA-exim] Thanks for sa-exim, and a feature for the wishlist In-Reply-To: <200703071650.47441@proffe.kibibyte.se> References: <200703071329.08616.ediaz@ultreia.es> <20070307152713.GC12361@merlins.org> <200703071650.47441@proffe.kibibyte.se> Message-ID: <20070307162823.GE12361@merlins.org> On Wed, Mar 07, 2007 at 04:50:44PM +0100, Magnus Holmgren wrote: > > On Wed, Mar 07, 2007 at 01:29:08PM +0100, Eduardo Diaz Comellas wrote: > > > My feature request is to be able to control the headers generated and the > > > report of spamassassin. Lasts versions of exim include an spamassassin > > > connector which allows to customize the headers generated while scanning > > > the mail. I would love to have this feature in sa-exim. > > What kind of headers? One can add various headers from SpamAssassin, and all > those (that beging with X-Spam-) are added back by SA-Exim. Indeed, thanks for mentioning that first, I should have started with the obvious :) Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 307 bytes Desc: Digital signature Url : http://lists.merlins.org/archives/sa-exim/attachments/20070307/28c0e40e/attachment.pgp From kristopher.austin at oc.edu Thu Mar 15 09:27:59 2007 From: kristopher.austin at oc.edu (Kristopher Austin) Date: Thu, 15 Mar 2007 11:27:59 -0500 Subject: [SA-exim] spamc child yielded errors Message-ID: <0B91381A437EEF49AA5ED37EC5EDD555047885BB@fsmail.oc.edu> Over the past month or so I've been receiving this error on my mail gateways every couple of days. Everything seems to be flowing correctly, but I can't figure out why this message is showing up in my paniclogs. SA: PANIC: wait on spamc child yielded, 10 (but message was accepted) Does anyone have any advice on this? Thanks, Kris -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.merlins.org/archives/sa-exim/attachments/20070315/4c29ce2a/attachment-0001.htm From nomad at null.net Thu Mar 15 12:09:31 2007 From: nomad at null.net (Mark Lawrence) Date: Thu, 15 Mar 2007 20:09:31 +0100 (CET) Subject: [SA-exim] spamc child yielded errors In-Reply-To: <0B91381A437EEF49AA5ED37EC5EDD555047885BB@fsmail.oc.edu> References: <0B91381A437EEF49AA5ED37EC5EDD555047885BB@fsmail.oc.edu> Message-ID: > Over the past month or so I've been receiving this error on my mail > gateways every couple of days. Everything seems to be flowing > correctly, but I can't figure out why this message is showing up in my > paniclogs. > > SA: PANIC: wait on spamc child yielded, 10 (but message was accepted) Unfortunately I don't have any advice, but I have perhaps seen something related. On my systems I have an extraordinary amount of connections which are hanging around in the TIME_WAIT state: $ netstat -at | grep TIME_WAIT | grep spamd | wc -l $ 41 It might be possible that spamd is not finishing the conversation with spamc properly or not closing TCP connections cleanly? Regards, Mark. -- Mark Lawrence