Skip to main content

Prefork: Killing failed child in spamd status

Answered
rhm.geerts
  • Edited

When checking the spamd status I see these messages:

May 13 19:54:49 server.mydomain.nl spamd[3553189]: spamd: server successfully spawned child process, pid 3553396
May 13 19:54:49 server.mydomain.nl spamd[3553189]: spamd: server successfully spawned child process, pid 3553397
May 13 19:54:49 server.mydomain.nl spamd[3553189]: prefork: child states: IS
May 13 19:54:49 server.mydomain.nl spamd[3553189]: prefork: child states: II
May 13 19:54:51 server.mydomain.nl spamd[3553189]: prefork: killing failed child 3553397 fd=8 at /usr/local/cpanel/3rdparty/perl/536/cpanel-lib/Ma>
May 13 19:54:51 server.mydomain.nl spamd[3553189]: prefork: killed child 3553397
May 13 19:54:51 server.mydomain.nl spamd[3553189]: prefork: killing failed child 3553396 fd=7 at /usr/local/cpanel/3rdparty/perl/536/cpanel-lib/Ma>
May 13 19:54:51 server.mydomain.nl spamd[3553189]: prefork: killed child 3553396
May 13 19:54:51 server.mydomain.nl spamd[3553189]: spamd: handled cleanup of child pid [3553396] due to SIGCHLD: interrupted, signal 2 (0002)
May 13 19:54:51 server.mydomain.nl systemd[1]: Started Apache SpamAssassin™ deferral daemon.

It keeps doing this every time I check the status, only the child numbers change.
I've seen a similar kind of topic of 9 years ago, but no solution in there.

Only thing changed recently is creating a custom.cf file with this content:
dns_server 127.0.0.1
dns_query_restriction deny sa-trusted.bondedsender.org
dns_query_restriction deny sa-accredit.habeas.com
dns_query_restriction deny bl.score.senderscore.com

What is causing this issue and how can I fix it? A force cpupdate did not fix it, tried that already.

This is the full line of the error, just found it.
killing failed child 3633863 fd=8 at /usr/local/cpanel/3rdparty/perl/536/cpanel-lib/Mail/SpamAssassin/SpamdForkScaling.pm line 169.

Comments

6 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey hey!  Can you let me know specifically how you're checking the status? 

    0
  • rhm.geerts

    Hello cPRex.

    Sure, I use the appropriate command for it:
    systemctl spamd status

    The error is gone today and now it showed this:

    May 14 16:27:39 server.mydomain.nl spamd[78450]: HashBL: KAM_MESSAGE_HASHBL_FREEMAIL acl 'freemail' not defined
    May 14 16:27:39 server.mydomain.nl spamd[78450]: HashBL: PCCC_HASHBL_FREEMAIL acl 'freemail' not defined
    May 14 16:27:41 server.mydomain.nl spamd[78450]: check: dns_block_rule RCVD_IN_ZEN_BLOCKED_OPENDNS hit, creating /root/.spamassassin/dnsblock_zen.>

    I have no clue as where this freemail is coming from.
    And the opendns hit of Spamhaus is also odd as I have this in the local.cf file:
    dns_server 127.0.0.1

    But if I restart spamd with the command:
    /usr/local/cpanel/scripts/restartsrv_spamd   

    Then again the errors are shown again:

    [root@server: ~]# /usr/local/cpanel/scripts/restartsrv_spamd                                             
    Waiting for “spamd” to restart ………waiting for “spamd” to initialize ………finished.

    Service Status
            spamd (spamd-dormant: waiting for connections [5,6] --allowed-ips=127.0.0.1,::1 --max-children=5 --pidfile=/var/run/spamd.pid --listen=5,6) is running as root with PID 555559 (systemd+/proc check method).

    Startup Log
            May 14 16:37:09 server.mydomain.nl spamd[555559]: spamd: server successfully spawned child process, pid 555744
            May 14 16:37:09 server.mydomain.nl spamd[555559]: spamd: server successfully spawned child process, pid 555745
            May 14 16:37:09 server.mydomain.nl spamd[555559]: prefork: child states: IS
            May 14 16:37:09 server.mydomain.nl spamd[555559]: prefork: child states: II
            May 14 16:37:11 server.mydomain.nl spamd[555559]: prefork: killing failed child 555744 fd=7 at /usr/local/cpanel/3rdparty/perl/536/cpanel-lib/Mail/SpamAssassin/SpamdForkScaling.pm line 169.
            May 14 16:37:11 server.mydomain.nl spamd[555559]: prefork: killed child 555744
            May 14 16:37:11 server.mydomain.nl spamd[555559]: prefork: killing failed child 555745 fd=8 at /usr/local/cpanel/3rdparty/perl/536/cpanel-lib/Mail/SpamAssassin/SpamdForkScaling.pm line 169.
            May 14 16:37:11 server.mydomain.nl spamd[555559]: prefork: killed child 555745
            May 14 16:37:11 server.mydomain.nl spamd[555559]: spamd: handled cleanup of child pid [555745] due to SIGCHLD: interrupted, signal 2 (0002)
            May 14 16:37:11 server.mydomain.nl systemd[1]: Started Apache SpamAssassin™ deferral daemon.

    However only then, it does not show in the status output at this moment anymore. At this moment only when restarting spamd.

    0
  • cPRex Jurassic Moderator

    That seems like normal output to me as it's now just showing you the log data from the restart.

    As far as the "freemail" issue, that can be ignored as well as it is just an option with SpamAssassin that hasn't been configured:

    https://support.cpanel.net/hc/en-us/community/posts/29607095555223-Spamassassin-KAM-HashBL-Warnings

    I would expect you're still seeing mail processed and marked as spam at this time.

    0
  • rhm.geerts

    Yes thank you. From the freemail I've read in the meantime, so I don't worry about that anymore.

    Since the error is gone from the status I'm satisfied with that too.

    Seems we're just still in the blocklist of Spamhaus for doing queries.
    But we have that on multiple servers, not only cPanel, in spite of the fact that we all use a local caching dns resolver, not an open resolver.
    Since we experienced this suddenly on all servers, we're wondering if Spamhaus changed something with the free query limits.

    spamd[27823]: check: dns_block_rule RCVD_IN_ZEN_BLOCKED_OPENDNS hit, creating /root/.spamassassin/dnsblock_zen

    But that's out of the scope of this post. If it keeps going on I will use either my free account with Spamhaus or just disable it from Spamassassin.

    So this post can be seen as solved for now as far as I'm concerned.

    Thank you!

    0
  • mtindor

    You should sign up for the DQS stuff on Spamhaus.  Then you can use whatever nameservers you want.

     

    Isn't RCVD_IN_ZEN_BLOCKED_OPENDNS suggesting that the servers querying Spamhaus are actually OpenDNS servers and not your local resolvers.  If your local resolvers aren't what you have listed in /etc/resolv.conf and instead you have opendns servers listed in /etc/resolv.conf, then there is your issue with Spamhaus.

    These should not be in your /etc/resolv.conf if you want to query spamhaus

    • 208.67.222.222.
    • 208.67.220.220

    Unless you actually modify /etc/mail/spamassassin/local.cf and add your local resolvers there:

    /etc/mail/spamassassin/local.cf

    dns_server #.#.#.#
    dns_server #.#.#.#

     - where #.#.#.# are your local resolvers

    If you set the resolvers to use in local.cf for spamassassin usage, then you can use whatever resolvers you want in /etc/resolv.conf.   However, if you are using Spamhaus as an RBL during SMTP time, that might get limited/blocked too and would not be using the local.cf from spamassassin but would be using your resolvers in /etc/resolv.conf

    It took me years to bite the bullet and just get an account on Spamhaus for DQS.   It has worked out great, and I'm sorry I didn't do it earlier.

    Mike

     

     

    0
  • rhm.geerts
    • Edited

    Thank you for the tip, I'm aware of the DQS account, I just created one wednesday afternoon.
    But if I'm not mistaken if you have the free account there is also a certain limit for queries and I have 2 other servers (with DA) on that account at the moment which are my own.
    I could use them also for the cPanel server which I'm administrating for a friend.
    However I'm not sure if this would faster lead to the free account limits. I didn't understand that part well enough as I'm not native English. Do you know the query limits on SA with the free DQS account by any chance?

    I always used a local resolver on both /etc/resolv.conf and local.cf and it has been working fine for many years. So no issue there.
    I always had it like this in /etc/resolv.conf for years:
    127.0.0.1
    1.1.1.1
    datacenter ip

    Or with 1.1.1 as 3rd so the local resolver was looked at first anyway, but since it was also in local.cf SA always used the local resolver anyway.

    However, you might have hit a good point which I thought of too last evening.
    Fairly recently I had added zen.spamhaus.org to my RBL list at SMTP time on my DA servers and is was also active here in CPanel. I just don't remember if I activated it in cPanel recently too or longer ago.
    This would ofcourse have caused double checks (Exim and SA). Which could have caused the limit to be exceeded. I've removed them from RBL at SMTP time last evening.

    If the free limits for DQS are high enough, I could use the Github plugin for cPanel too. Because as you also experienced, it makes live easier. :)

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post