SpamAssassin for windows...works, but doesn't work...wtf?

[evanrich]

I downloaded and installed Spam Assassin for Windows (from Jam Software's site), and ran SpamD on my Windows Server 2008 R2 x64 box. It looks to launch correctly, (I even ran it as admin and with 2003 compatibility) however it looks like Hmailserver can't talk to spamassassin...yet I can see it does. Let me elaborate:

After I see in the cmd prompt for spamassassin that it's started, I went into the admin interface for Hmailserver and hit "test". In the CMD window, I can see data getting fed in:

Code: Select all

Nov  8 11:17:01.896 [-3876] info: spamd: connection from WHITE-DWARF [127.0.0.1]
 at port 55983
Nov  8 11:17:01.912 [-3876] info: spamd: processing message (unknown) for (unkno
wn):0
Nov  8 11:17:42.229 [-3876] warn: razor2: razor2 check failed: Unknown error raz
or2: razor2 had unknown error during get_server_info at /<C:\Program Files (x86)
\JAM Software\SpamAssassin for Windows\sawin.dll>Mail/SpamAssassin/Plugin/Razor2
.pm line 190, <GEN44> line 1. at /<C:\Program Files (x86)\JAM Software\SpamAssas
sin for Windows\sawin.dll>Mail/SpamAssassin/Plugin/Razor2.pm line 330, <GEN44> l
ine 1.
Nov  8 11:17:42.299 [-3876] info: spamd: identified spam (6.9/6.3) for (unknown)
:0 in 40.4 seconds, 0 bytes.
Nov  8 11:17:42.300 [-3876] info: spamd: result: Y 6 - EMPTY_MESSAGE,MISSING_DAT
E,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,NO_HEADERS_MESSAGE,NO_RECEIVED,NO_
RELAYS scantime=40.4,size=0,user=(unknown),uid=0,required_score=6.3,rhost=WHITE-
DWARF,raddr=127.0.0.1,rport=55983,mid=(unknown),autolearn=no
Nov  8 11:17:42.602 [1308] info: prefork: child states: II

but after it finishes, Hmailserver pops a box saying that it was unable to communicate with SA server. Even still, I can see emails getting processed in the SA window, yet HMS's log indicates errors talking to SA.

Does anyone have an idea? the only thing that I could think of is maybe since it's taking around 40 second to process the spam message that HMS is timing out waiting for a response from SA? I'm running this on a Single comre Atom 230 processor, so may not be enough resources available to process any faster.

Thanks, I'm running HMS 5.3.3

[tBB]

AFAIK hMS has a hardcoded 30 second timeout for the whole AV/Anti-Spam process (Hmm...Bill, are you there? ) and most probably one (or all) of the on-line tests (RBL, Razor, SURBL etc) has a timeout. You could enable the log in SpamD and check which one and why, or disable them and check again.

Best regards,

Nico

[Bill48105]

Sounds about right Nico but I'd have to look at the code again. Either way best to get SA working correctly before trying to use with hmail.. Run up spamassassin --lint -D looking for errors & to see how long it takes from start (when you press enter) til finish (back at command prompt). If it's taking more than 5-10 seconds you either have some setup error (lame DNS setup?), outdated hardware or such & no prayer to get it to work right with any mail server..
Btw I just tried on my virtual machine I use & it took <5 seconds.
Bill

[tBB]

Run up spamassassin --lint -D looking for errors & to see how long it takes from start (when you press enter) til finish (back at command prompt). If it's taking more than 5-10 seconds you either have some setup error (lame DNS setup?), outdated hardware or such & no prayer to get it to work right with any mail server..
Btw I just tried on my virtual machine I use & it took <5 seconds.

Uhm...does "spamassassin -lint" only check the rules or also the online tests? Besides, loading the rules takes much longer for spamassassin.exe than if SpamD is used and on slower machines (such as a Atom) loading the rules might also take a while so this is not really the time hMS needs when it connects to SpamD.

BTW: Long time ago I had a boring discussion here about the hardcoded hMS timeout with that strange user (forgot his name) who deleted all of his posts after he clashed with Martin. There I suggested to make the timeout configurable because on slower machines and/or slower connections 30 seconds might be too tight if SpamAssassin with a lot of rules/online tests and/or ClamAV with a lot of third party signatures are used. Martin (as usual) didn't comment on it but wouldn't that be a job for you to make that configurable, at least in the .ini? Sorry, I still haven't looked at the svn

Best regards,

Nico

[evanrich]

wow.. quick replies, definately looks like more of a helpful forum than some others out there.

Just ran the spamassassin --lint -D and it took 19 seconds (tested with windows clock). Not sure if it's supposed to or not, but it ran a ton of messages by the screen while doing it.

So I take it that since I take at least 13 seconds longer than your test did, that that would only leave about 15 seconds to check for anything online? I can see the window doing activity but I'm nearly positive that HMS is just timing out waiting for a response from SA.

While running the test, I see CPU usage goes up to about 56% but no higher, total CPU usage is at around 75 during the test. If necessary I can upgrade to the dual core version, but the box this is on was built to draw as little power as possible. ( green drives, lower power cpu, etc)

Thanks!

[Bill48105]

Uhm...does "spamassassin -lint" only check the rules or also the online tests? Besides, loading the rules takes much longer for spamassassin.exe than if SpamD is used and on slower machines (such as a Atom) loading the rules might also take a while so this is not really the time hMS needs when it connects to SpamD.

BTW: Long time ago I had a boring discussion here about the hardcoded hMS timeout with that strange user (forgot his name) who deleted all of his posts after he clashed with Martin. There I suggested to make the timeout configurable because on slower machines and/or slower connections 30 seconds might be too tight if SpamAssassin with a lot of rules/online tests and/or ClamAV with a lot of third party signatures are used. Martin (as usual) didn't comment on it but wouldn't that be a job for you to make that configurable, at least in the .ini? Sorry, I still haven't looked at the svn

Best regards,

Nico

I'm 99% sure it runs up everything.. Thought that was the point of the test. lol And yeah I wasn't expecting it to use spamD.. It is just an easy test t run from command line that tests the config & output is viewable right there.

Yeah spamd & clamd timeouts/failover/balancing is on my todo. But as I said it is very important sa/clam be setup properly as often slow results are a problem with setup & not necessarily just old/slow hardware. And in case you didn't catch it yes failover/load-balancing means hmail can run up more than 1 sa/clam server. As far as martin, he has final say but he's also made it clear he's open to most anything as long as it fits with his view of hmailserver being easy to setup & run & work right. That being said I try my best to make sure everything I do defaults to the current way for now so people who don't want it can ignore or be blissfully ignorant (not meant in derogatory way btw) as to the special 'super advanced geekfest' features I work in but for those who care for such things they should be capable of editing an INI & understanding wth they are doing to even bother or care. If at some point those things make sense to be on by default or readily used then I'm sure they'll be made more user-friendly & integrated into the GUI admin etc as time permits.

Oh that person was well before me & I have no idea really what happened other than a few posts I run across & wasn't sure how to take it. Seems like a childish/immature thing to do but hey guess it wasn't me so no idea what was behind such an extreme action. So life goes on & turn the page. NEXT!
Bill

[Bill48105]

wow.. quick replies, definately looks like more of a helpful forum than some others out there.

Just ran the spamassassin --lint -D and it took 19 seconds (tested with windows clock). Not sure if it's supposed to or not, but it ran a ton of messages by the screen while doing it.

So I take it that since I take at least 13 seconds longer than your test did, that that would only leave about 15 seconds to check for anything online? I can see the window doing activity but I'm nearly positive that HMS is just timing out waiting for a response from SA.

While running the test, I see CPU usage goes up to about 56% but no higher, total CPU usage is at around 75 during the test. If necessary I can upgrade to the dual core version, but the box this is on was built to draw as little power as possible. ( green drives, lower power cpu, etc)

Thanks!

Hmm 19 seconds isn't really super long especially for 1st run. Did you run it again to see how long that took? If RBL lookups & such get cached it should be a lot fast. Your cpu usage doesn't seem too bad either. Often delays in SA are caused by bad config or DNS not working right. Yeah it'll scroll a lot by. On nix you shift-page up/down to see but on windows you'll likely be best to pipe to more or redirect to a file & view in notepad or such. Of course you can also just view the SA logs. Between output of --line -D & SA logs you should be able to narrow down to which tests are taking a long time. My $ is on DNS-related ones & you need to get that worked out or disabled in SA. (Keep in mind if you have DNS blacklist stuff enabled in hmail during connection it is likely doubled up in SA if same tests are done. You might consider disabling those tests in SA to speed it up & rely on hmail to do the DNS-based ones..) You might think about setting up local DNS server too which isn't terribly difficult to be used just for caching and direct dns lookups although your ISP can't block outbound port 53 to places besides them for it to work.. Or make sure you don't have a lame-dns server in your setup.
Bill

[evanrich]

I looked at the log, and everything looks to run through sequentially about once per second, nothing really gets delayed much.

I started tweaking some of the settings in v320.pre, turning off some of the checks. Now I get about 15 seconds, and when I click "test" in HMS, I get a box that pops up saying "MEssage viewer", a tmp file, and what looks like an email.....is this expected behavior? if so then I got it working it seems, and can start tweaking the settings again to load the plugins until it breaks.


Thanks again everyone!

Edit: I disabled the Razor check, and that seems to have fixed it.

[Bill48105]

Hewdy. OK cool yeah the window show should the output from SA for the test hmail sends to it to show it is working. So seems you got it working but also points to need for us to look into the hmail timeouts as 19 seconds should not be too long.. (Still not convinced an error in SA wasn't causing the problem but I would have had to see it or reproduce here.)
Bill

[Bill48105]

I had a few minutes so I checked out the code and timeout is definitely hard-coded to 30 seconds BUT that being said evanrich's problem was not a timeout.. What happened is the razor error caused SA to spit out something besides what hmail expected (that 'garbage' displayed in the results window that was supposed to be the tested message) which in turn caused hmail to throw that error which was the correct response for the hmail test to do. Perhaps the GUI should give better indication of what to expect & what the results mean but at this point it is up to correct user interpretation. Perhaps others running into problems later will find this thread & realize the issue & how to fix it.
Bill

[Bill48105]

It wouldn't let me edit my previous post but the exact message from hmail is actually pretty informative:

There was a communication error with SpamAssassin.
hMailServer tried to retrieve data from SpamAssassin but the connection
to SpamAssassin was lost. The WinSock error code is %d. Enable debug
logging to retrieve more information regarding this problem.
The problem could be that SpamAssassin is malfunctioning.

[tBB]

I had a few minutes so I checked out the code and timeout is definitely hard-coded to 30 seconds BUT that being said evanrich's problem was not a timeout..

One of his problems was definitely a timeout because:

since it's taking around 40 second to process the spam message

Keep in mind that 30 seconds is the allowed timeframe for all of the Anti-Virus and Anti-Spam tests together, not for each of them.

What happened is the razor error caused SA to spit out something besides what hmail expected (that 'garbage' displayed in the results window that was supposed to be the tested message) which in turn caused hmail to throw that error which was the correct response for the hmail test to do

Was it the same Razor error that evanrich posted at the top of this thread (unknown error during get_server_info) or something different? That error occurs if Razor can't connect to discovery.spamnet.com for some reason but the log should definately tell. If it was something different, do you remember what the error was? I'm in contact with the developer of that SA version so if it's something worth to report I should tell him.

If -lint checks the on-line tests too it's also strange that it didn't catch the Razor error.

Best regards,

Nico

[Bill48105]

Too many questions & answers rolling around & easy to mix things up.. Fact is the way hmail is setup to interface with SA if there is a problem, including if the response is not what is expected as well if size is not what is expected, that error message occurs. If it really was taking SA 40 seconds then no doubt it was a timeout. But if SA has a configuration problem and spits out something unexpected then that's a problem too. Thing is is SA is taking too long odds are it's a configuration problem and should be fixed not have hmail timeout cracked up to 10 minutes. (Btw don't get me wrong I'm all for a setting to set it but like most settings it needs to be used properly with some common sense or it will bring on more problems & complaints..)
Bill

[paragshedbale]

All I had to do was restart the spamassasin service. Windows Server 2016, hMailServer.

[RvdH]

All I had to do was restart the spamassasin service. Windows Server 2016, hMailServer.

Really??? Why reply to a ten year old thread?

[jimimaseye]

All I had to do was restart the spamassasin service. Windows Server 2016, hMailServer.

Really??? Why reply to a ten year old thread?

Building his posting count so he can then drop in a spam post with a hidden hyperlink and hope that I wont notice.

But I have. I ALWAYS do. They might think they are smart....but Im smarter!