[Pkg-exim4-users] exim paniclog on thelma has non-zero size

[Rich McAllister]

Ross Boylan wrote:
> On Tue, 2008-10-07 at 13:08 -0500, Robert Steinmetz AIA wrote:
>> I got this error in the panic log.
>>
>> 2008-10-03 15:17:21 1Klq15-0003wz-TM spam acl condition: error reading 
>> from spam
>> d socket: Connection timed out
>>
>> Nothing since that date and time.
>>
>> Is it something I should be concerned about?
> I see such warnings fairly routinely.  I have always taken then to mean
> that spamd got momentarily overloaded, and things seem to proceed OK
> after that.  However, I have a feeling they indicate some problem that I
> just haven't been able to identify.  And I don't really know what's
> going on.

I started getting a spate of these a couple months ago and looked into 
it.  What was happening was I was getting some really large spam 
messages (lots of embedded images.)  SpamAssassin was taking a long time 
to scan those, which meant that if several arrived in close succession 
eventually all the spamd instances were busy and these messages started 
appearing.

What I did was modify my spam ACLs so that "big" messages didn't get 
scanned by SpamAssassin:

   deny
     condition = ${if < {$message_size}{50K}}
     message = This message scored $spam_score spam points
     spam = Debian-exim
     condition = ${if >{$spam_score_int}{75}{1}{0}}

This drastically reduced the incidence of the paniclog messages, at the 
cost of a few extra spam messages in inboxes.   I still got an 
occasional paniclog message, which I attributed to just momentary bursts 
of traffic. I upgraded the server hardware and I haven't seen the 
paniclog messages since, but that's only been a week or so.

Rich