Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #199363 > unrolled thread

question on spamd logging

Back to article view | Back to linux.debian.user

Contents

  question on spamd logging Gene Heskett <gheskett@shentel.net> - 2018-08-25 17:30 +0200
    Re: question on spamd logging Gene Heskett <gheskett@shentel.net> - 2018-08-25 18:20 +0200
      Re: question on spamd logging Reco <recoverym4n@gmail.com> - 2018-08-25 19:10 +0200
        Re: question on spamd logging Gene Heskett <gheskett@shentel.net> - 2018-08-25 20:00 +0200
        Re: question on spamd logging Gene Heskett <gheskett@shentel.net> - 2018-08-25 20:00 +0200
          Re: question on spamd logging Reco <recoverym4n@gmail.com> - 2018-08-25 20:20 +0200
            Re: question on spamd logging Gene Heskett <gheskett@shentel.net> - 2018-08-25 23:30 +0200
    Re: question on spamd logging Reco <recoverym4n@gmail.com> - 2018-08-25 18:20 +0200

#199363 — question on spamd logging

Greetings all;

32 bit wheezy on 64 bit hardware here, for about 4 or 5 days yet as I 
have stuff to install stretch on a fedex truck someplace between the 
left coast and north central WV.

Ever since the main log being switched from /v/l/messages to /v/l/syslog, 
this syslog is getting spammed by spamd stuff everytime spamd looks at 
an incoming email. Several hundred stanza's of this in a typical day.

This is expanding the syslog to the point of drowning out any real 
actionable messages.

I think it used to have a log of its own. How, it this continues once 
stretch is up and running, can we put those spamd messages back into 
spamassassin's own log file? Seems like the logical place for them.

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [next] | [standalone]

#199365

On Saturday 25 August 2018 12:12:09 Reco wrote:

> 	Hi.
>
> On Sat, Aug 25, 2018 at 11:27:32AM -0400, Gene Heskett wrote:
> > This is expanding the syslog to the point of drowning out any real
> > actionable messages.
> >
> > I think it used to have a log of its own. How, it this continues
> > once stretch is up and running, can we put those spamd messages back
> > into spamassassin's own log file? Seems like the logical place for
> > them.
>
> It's definitely possible with rsyslog's filtering feature.
> Can you provide a sample of the records that annoy you?
>
> Reco

Aug 25 12:10:01 coyote /USR/SBIN/CRON[20245]: (www-data) CMD ([ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh)
Aug 25 12:11:33 coyote spamd[4854]: spamd: connection from localhost [127.0.0.1]:43518 to port 783, fd 5
Aug 25 12:11:33 coyote spamd[4854]: spamd: setuid to gene succeeded
Aug 25 12:11:33 coyote spamd[4854]: spamd: processing message <20180825161027.eaq2xy65oiar6fqz@p5k.home> aka <AgA_oytFLPE.A.wcD.I-XgbB@bendel> for gene:1000
Aug 25 12:11:34 coyote spamd[4854]: spamd: clean message (1.6/5.1) for gene:1000 in 1.1 seconds, 10538 bytes.
Aug 25 12:11:34 coyote spamd[4854]: spamd: result: . 1 - BAYES_50,HEADER_FROM_DIFFERENT_DOMAINS,RDNS_NONE,T_DKIM_INVALID 
scantime=1.1,size=10538,user=gene,uid=1000,required_score=5.1,rhost=localhost,raddr=127.0.0.1,rport=43518,mid=<20180825161027.eaq2xy65oiar6fqz@p5k.home>,rmid=<AgA_oytFLPE.A.wcD.I-XgbB@bendel>,bayes=0.500000,autolearn=no 
autolearn_force=no
Aug 25 12:11:35 coyote spamd[4707]: prefork: child states: II

Several hundred a day...

Thanks Reco

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#199367

	Hi.

On Sat, Aug 25, 2018 at 12:16:49PM -0400, Gene Heskett wrote:
> On Saturday 25 August 2018 12:12:09 Reco wrote:
> 
> > 	Hi.
> >
> > On Sat, Aug 25, 2018 at 11:27:32AM -0400, Gene Heskett wrote:
> > > This is expanding the syslog to the point of drowning out any real
> > > actionable messages.
> > >
> > > I think it used to have a log of its own. How, it this continues
> > > once stretch is up and running, can we put those spamd messages back
> > > into spamassassin's own log file? Seems like the logical place for
> > > them.
> >
> > It's definitely possible with rsyslog's filtering feature.
> > Can you provide a sample of the records that annoy you?
> >
> > Reco
> 
> Aug 25 12:10:01 coyote /USR/SBIN/CRON[20245]: (www-data) CMD ([ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh)
> Aug 25 12:11:33 coyote spamd[4854]: spamd: connection from localhost [127.0.0.1]:43518 to port 783, fd 5
> Aug 25 12:11:33 coyote spamd[4854]: spamd: setuid to gene succeeded
> Aug 25 12:11:33 coyote spamd[4854]: spamd: processing message <20180825161027.eaq2xy65oiar6fqz@p5k.home> aka <AgA_oytFLPE.A.wcD.I-XgbB@bendel> for gene:1000
> Aug 25 12:11:34 coyote spamd[4854]: spamd: clean message (1.6/5.1) for gene:1000 in 1.1 seconds, 10538 bytes.
> Aug 25 12:11:34 coyote spamd[4854]: spamd: result: . 1 - BAYES_50,HEADER_FROM_DIFFERENT_DOMAINS,RDNS_NONE,T_DKIM_INVALID 
> scantime=1.1,size=10538,user=gene,uid=1000,required_score=5.1,rhost=localhost,raddr=127.0.0.1,rport=43518,mid=<20180825161027.eaq2xy65oiar6fqz@p5k.home>,rmid=<AgA_oytFLPE.A.wcD.I-XgbB@bendel>,bayes=0.500000,autolearn=no 
> autolearn_force=no
> Aug 25 12:11:35 coyote spamd[4707]: prefork: child states: II
> 
> Several hundred a day...

Try this:

cat > /etc/rsyslog.d/spamd.conf << EOF
:syslogtag, startswith, "spamd" /var/log/spamd.log
:syslogtag, startswith, "spamd" stop
EOF

service rsyslogd restart

Consider adding logrotate configuration file for the new
/var/log/spamd.log.

And, before you ask, documentation for rsyslogd lives in "rsyslog-doc"
package.

Reco

[toc] | [prev] | [next] | [standalone]

#199368

On Saturday 25 August 2018 13:08:29 Reco wrote:

> 	Hi.
>
> On Sat, Aug 25, 2018 at 12:16:49PM -0400, Gene Heskett wrote:
> > On Saturday 25 August 2018 12:12:09 Reco wrote:
> > > 	Hi.
> > >
> > > On Sat, Aug 25, 2018 at 11:27:32AM -0400, Gene Heskett wrote:
> > > > This is expanding the syslog to the point of drowning out any
> > > > real actionable messages.
> > > >
> > > > I think it used to have a log of its own. How, it this continues
> > > > once stretch is up and running, can we put those spamd messages
> > > > back into spamassassin's own log file? Seems like the logical
> > > > place for them.
> > >
> > > It's definitely possible with rsyslog's filtering feature.
> > > Can you provide a sample of the records that annoy you?
> > >
> > > Reco
> >
> > Aug 25 12:10:01 coyote /USR/SBIN/CRON[20245]: (www-data) CMD ([ -x
> > /usr/share/awstats/tools/update.sh ] &&
> > /usr/share/awstats/tools/update.sh) Aug 25 12:11:33 coyote
> > spamd[4854]: spamd: connection from localhost [127.0.0.1]:43518 to
> > port 783, fd 5 Aug 25 12:11:33 coyote spamd[4854]: spamd: setuid to
> > gene succeeded Aug 25 12:11:33 coyote spamd[4854]: spamd: processing
> > message <20180825161027.eaq2xy65oiar6fqz@p5k.home> aka
> > <AgA_oytFLPE.A.wcD.I-XgbB@bendel> for gene:1000 Aug 25 12:11:34
> > coyote spamd[4854]: spamd: clean message (1.6/5.1) for gene:1000 in
> > 1.1 seconds, 10538 bytes. Aug 25 12:11:34 coyote spamd[4854]: spamd:
> > result: . 1 -
> > BAYES_50,HEADER_FROM_DIFFERENT_DOMAINS,RDNS_NONE,T_DKIM_INVALID
> > scantime=1.1,size=10538,user=gene,uid=1000,required_score=5.1,rhost=
> >localhost,raddr=127.0.0.1,rport=43518,mid=<20180825161027.eaq2xy65oia
> >r6fqz@p5k.home>,rmid=<AgA_oytFLPE.A.wcD.I-XgbB@bendel>,bayes=0.500000
> >,autolearn=no autolearn_force=no
> > Aug 25 12:11:35 coyote spamd[4707]: prefork: child states: II
> >
> > Several hundred a day...
>
> Try this:
>
> cat > /etc/rsyslog.d/spamd.conf << EOF
>
> :syslogtag, startswith, "spamd" /var/log/spamd.log
> :syslogtag, startswith, "spamd" stop
>
> EOF
>
> service rsyslogd restart
>
> Consider adding logrotate configuration file for the new
> /var/log/spamd.log.
>
> And, before you ask, documentation for rsyslogd lives in "rsyslog-doc"
> package.
>
> Reco

but it did move the noise to spamd.log.  Thanks a bunch Reco.


-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#199369

On Saturday 25 August 2018 13:08:29 Reco wrote:

> 	Hi.
>
> On Sat, Aug 25, 2018 at 12:16:49PM -0400, Gene Heskett wrote:
> > On Saturday 25 August 2018 12:12:09 Reco wrote:
> > > 	Hi.
> > >
> > > On Sat, Aug 25, 2018 at 11:27:32AM -0400, Gene Heskett wrote:
> > > > This is expanding the syslog to the point of drowning out any
> > > > real actionable messages.
> > > >
> > > > I think it used to have a log of its own. How, it this continues
> > > > once stretch is up and running, can we put those spamd messages
> > > > back into spamassassin's own log file? Seems like the logical
> > > > place for them.
> > >
> > > It's definitely possible with rsyslog's filtering feature.
> > > Can you provide a sample of the records that annoy you?
> > >
> > > Reco
> >
> > Aug 25 12:10:01 coyote /USR/SBIN/CRON[20245]: (www-data) CMD ([ -x
> > /usr/share/awstats/tools/update.sh ] &&
> > /usr/share/awstats/tools/update.sh) Aug 25 12:11:33 coyote
> > spamd[4854]: spamd: connection from localhost [127.0.0.1]:43518 to
> > port 783, fd 5 Aug 25 12:11:33 coyote spamd[4854]: spamd: setuid to
> > gene succeeded Aug 25 12:11:33 coyote spamd[4854]: spamd: processing
> > message <20180825161027.eaq2xy65oiar6fqz@p5k.home> aka
> > <AgA_oytFLPE.A.wcD.I-XgbB@bendel> for gene:1000 Aug 25 12:11:34
> > coyote spamd[4854]: spamd: clean message (1.6/5.1) for gene:1000 in
> > 1.1 seconds, 10538 bytes. Aug 25 12:11:34 coyote spamd[4854]: spamd:
> > result: . 1 -
> > BAYES_50,HEADER_FROM_DIFFERENT_DOMAINS,RDNS_NONE,T_DKIM_INVALID
> > scantime=1.1,size=10538,user=gene,uid=1000,required_score=5.1,rhost=
> >localhost,raddr=127.0.0.1,rport=43518,mid=<20180825161027.eaq2xy65oia
> >r6fqz@p5k.home>,rmid=<AgA_oytFLPE.A.wcD.I-XgbB@bendel>,bayes=0.500000
> >,autolearn=no autolearn_force=no
> > Aug 25 12:11:35 coyote spamd[4707]: prefork: child states: II
> >
> > Several hundred a day...
>
> Try this:
>
> cat > /etc/rsyslog.d/spamd.conf << EOF
>
> :syslogtag, startswith, "spamd" /var/log/spamd.log
> :syslogtag, startswith, "spamd" stop
>
> EOF
>
> service rsyslogd restart
>
no permission

so I cd to e/rs.d sudo -i and made this file
:syslogtag, startswith, "spamd" /var/log/spamd.log
:syslogtag, startswith, "spamd" stop

And had to do the restart as root, which logged this:
Aug 25 13:34:45 coyote rsyslogd: [origin software="rsyslogd" 
swVersion="7.6.3" x-pid="3079" x-info="http://www.rsyslog.com"] exiting 
on signal 15.
Aug 25 13:34:45 coyote rsyslogd: [origin software="rsyslogd" 
swVersion="7.6.3" x-pid="23099" x-info="http://www.rsyslog.com"] start
Aug 25 13:34:45 coyote rsyslogd-3000: unknown priority name ""

No clue what that error might be, you?

Thanks Reco.

> Consider adding logrotate configuration file for the new
> /var/log/spamd.log.
>
> And, before you ask, documentation for rsyslogd lives in "rsyslog-doc"
> package.

Synaptic says its installed, but its not on /usr/share?

Ahh, found it but no mention of that exact syntax of :syslogtag
>
> Reco



-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#199370

	Hi.

On Sat, Aug 25, 2018 at 01:49:53PM -0400, Gene Heskett wrote:
> > > Aug 25 12:11:35 coyote spamd[4707]: prefork: child states: II
> > >
> > > Several hundred a day...
> >
> > Try this:
> >
> > cat > /etc/rsyslog.d/spamd.conf << EOF
> >
> > :syslogtag, startswith, "spamd" /var/log/spamd.log
> > :syslogtag, startswith, "spamd" stop
> >
> > EOF
> >
> > service rsyslogd restart
> >
> no permission

I assumed that I could skip obligatory 'please assume root privileges
before making systemwide changes'. Apparently I was wrong, but …


> so I cd to e/rs.d sudo -i and made this file
> :syslogtag, startswith, "spamd" /var/log/spamd.log
> :syslogtag, startswith, "spamd" stop

… since things worked out themselves, we now have this:


> And had to do the restart as root, which logged this:
> Aug 25 13:34:45 coyote rsyslogd: [origin software="rsyslogd" 
> swVersion="7.6.3" x-pid="3079" x-info="http://www.rsyslog.com"] exiting 
> on signal 15.
> Aug 25 13:34:45 coyote rsyslogd: [origin software="rsyslogd" 
> swVersion="7.6.3" x-pid="23099" x-info="http://www.rsyslog.com"] start

These two are you usual rsyslogd restart. Nothing to see here.


> Aug 25 13:34:45 coyote rsyslogd-3000: unknown priority name ""
> 
> No clue what that error might be, you?

But this one is sure cryptic. Even if one takes [1] into the account.
It's been awhile since I've tinkered with wheezy's rsyslogd, try
replacing "stop" with "~". I.e. replace:

:syslogtag, startswith, "spamd" stop

with:

:syslogtag, startswith, "spamd" ~


> Thanks Reco.

You're welcome.


> > Consider adding logrotate configuration file for the new
> > /var/log/spamd.log.
> >
> > And, before you ask, documentation for rsyslogd lives in "rsyslog-doc"
> > package.
> 
> Synaptic says its installed, but its not on /usr/share?

It should be /usr/share/doc/rsyslogd-doc.
I made a habit doing 'dpkg -L …' on newly installed packages.


> Ahh, found it but no mention of that exact syntax of :syslogtag

To put it simply, it's that thing that follows hostname in your typical
syslog entry. Usually comes in format "process_name[process_pid]".
In this case it's "spamd[4707]".

[1] https://www.rsyslog.com/?s=error+3000

Reco

[toc] | [prev] | [next] | [standalone]

#199373

On Saturday 25 August 2018 14:15:38 Reco wrote:

> 	Hi.
>
> On Sat, Aug 25, 2018 at 01:49:53PM -0400, Gene Heskett wrote:
> > > > Aug 25 12:11:35 coyote spamd[4707]: prefork: child states: II
> > > >
> > > > Several hundred a day...
> > >
> > > Try this:
> > >
> > > cat > /etc/rsyslog.d/spamd.conf << EOF
> > >
> > > :syslogtag, startswith, "spamd" /var/log/spamd.log
> > > :syslogtag, startswith, "spamd" stop
> > >
> > > EOF
> > >
> > > service rsyslogd restart
> >
> > no permission
>
> I assumed that I could skip obligatory 'please assume root privileges
> before making systemwide changes'. Apparently I was wrong, but …
>
> > so I cd to e/rs.d sudo -i and made this file
> >
> > :syslogtag, startswith, "spamd" /var/log/spamd.log
> > :syslogtag, startswith, "spamd" stop
>
> … since things worked out themselves, we now have this:
> > And had to do the restart as root, which logged this:
> > Aug 25 13:34:45 coyote rsyslogd: [origin software="rsyslogd"
> > swVersion="7.6.3" x-pid="3079" x-info="http://www.rsyslog.com"]
> > exiting on signal 15.
> > Aug 25 13:34:45 coyote rsyslogd: [origin software="rsyslogd"
> > swVersion="7.6.3" x-pid="23099" x-info="http://www.rsyslog.com"]
> > start
>
> These two are you usual rsyslogd restart. Nothing to see here.
>
> > Aug 25 13:34:45 coyote rsyslogd-3000: unknown priority name ""
> >
> > No clue what that error might be, you?
>
> But this one is sure cryptic. Even if one takes [1] into the account.
> It's been awhile since I've tinkered with wheezy's rsyslogd, try
>
> replacing "stop" with "~". I.e. replace:
> :syslogtag, startswith, "spamd" stop
>
> with:
> :syslogtag, startswith, "spamd" ~
> :
> > Thanks Reco.
>
> You're welcome.
>
> > > Consider adding logrotate configuration file for the new
> > > /var/log/spamd.log.
> > >
> > > And, before you ask, documentation for rsyslogd lives in
> > > "rsyslog-doc" package.
> >
> > Synaptic says its installed, but its not on /usr/share?
>
> It should be /usr/share/doc/rsyslogd-doc.
> I made a habit doing 'dpkg -L …' on newly installed packages.
>
> > Ahh, found it but no mention of that exact syntax of :syslogtag
>
> To put it simply, it's that thing that follows hostname in your
> typical syslog entry. Usually comes in format
> "process_name[process_pid]". In this case it's "spamd[4707]".
>
Ahh, so. Thanks.
> [1] https://www.rsyslog.com/?s=error+3000
>
Generic error, a placeholder IOW. Might be the stop at that because its 
running as a daemon and never shuts down except while rebooting.

> Reco

Back from the radio station now.  Gawd I hate intermittants that fix 
themselves 15 minutes after I've taken the obvious failure apart, 
cleaned all the contacts and it works when I put it back together, then 
drops out 30 minutes later for 20 minutes, and then comes back for the 
rest of the day. But I am a bit smarter for the next time it dies. I'll 
know where to put a couple scope probes next time, just as soon as I can 
get my scope out of the truck and get it powered up.

Thanks Reco.


-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#199366

	Hi.

On Sat, Aug 25, 2018 at 11:27:32AM -0400, Gene Heskett wrote:
> This is expanding the syslog to the point of drowning out any real 
> actionable messages.
> 
> I think it used to have a log of its own. How, it this continues once 
> stretch is up and running, can we put those spamd messages back into 
> spamassassin's own log file? Seems like the logical place for them.

It's definitely possible with rsyslog's filtering feature.
Can you provide a sample of the records that annoy you?

Reco

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web