[lug] spamassassin skipping e-mails: sigchild

[Ben]

I have spamassassin (3.1.7) installed on Debian stable (etch). I 
recently noticed some spams getting through our filter and when I looked 
closely, I saw that they weren't getting scanned at all. It looks like 
about 50% of the e-mails that come in aren't getting the 
"X-Spam-Check-Version" and "X-Spam-Status" headers appended to them.

I send two back-to-back e-mails from the same outside account 30 seconds 
apart. The first one got scanned properly. The second one had no SPAM 
headers on the e-mail message. Looking at the logs for spamd, for the 
e-mail that didn't get scanned I see:

Mar 27 09:31:24 inside postfix/qmgr[689]: 128DBBD61: 
from=<OUTSIDE at ADDRESS.COM>, size=1149, nrcpt=1 (queue active)
Mar 27 09:31:24 inside postfix/smtpd[16015]: disconnect from 
ADDRESS.COM[1.2.3.4]
Mar 27 09:31:24 inside spamd[15952]: spamd: connection from 
localhost.localdomain [127.0.0.1] at port 3242
Mar 27 09:31:24 inside spamd[15950]: prefork: child states: BI
Mar 27 09:31:24 inside spamd[15950]: spamd: handled cleanup of child pid 
15952 due to SIGCHLD
Mar 27 09:31:24 inside spamd[15950]: spamd: server successfully spawned 
child process, pid 16029
Mar 27 09:31:24 inside spamd[15950]: prefork: child states: II
Mar 27 09:31:24 inside postfix/pickup[14120]: 56916BF22: uid=333 
from=<OUTSIDE at ADDRESS.COM>
Mar 27 09:31:24 inside postfix/cleanup[16018]: 56916BF22: 
message-id=<1206632087.32457.1244612853 at ADDRESS.COM>
Mar 27 09:31:24 inside postfix/pipe[16019]: 128DBBD61: 
to=<INSIDE at LOCAL.COM>, relay=spamassassin, delay=0.29, delays=0.15/0/0/0.13,
 dsn=2.0.0, status=sent (delivered via spamassassin service)

I then sent two more messages from the same outside account to the same 
inside account, and got the same behavior. The first one got scanned, 
the second didn't and gave the SIGCHLD behavior in the logs. In both 
cases, no other e-mails came through during the time I send these 
e-mails, so I'm pretty sure this isn't load dependent. All I can find on 
google about this error is it being load dependent and related to the 
"--max-children" argument passed to spamassassin. But I'm not getting an 
error message about running out of children and I've tried increasing 
the max-children from 5 to 7 without any change (and this server was not 
getting any e-mails when I was testing this). Any ideas what's going wrong?


For reference, below is the log messages for the first e-mail that did 
get scanned:

Mar 27 09:31:01 inside spamd[15952]: spamd: connection from 
localhost.localdomain [127.0.0.1] at port 3241
Mar 27 09:31:01 inside spamd[15952]: spamd: processing message 
<1206632064.32457.1244612737 at ADDRESS.COM> for spam:333
Mar 27 09:31:01 inside spamd[15952]: spamd: clean message (0.0/4.0) for 
spam:333 in 0.3 seconds, 1118 bytes.
Mar 27 09:31:01 inside spamd[15952]: spamd: result: . 0 - BAYES_50 
scantime=0.3,size=1118,user=spam,uid=333,required_score=4.0,rhost=localhost
.localdomain,raddr=127.0.0.1,rport=3241,mid=<1206632064.32457.1244612737 at ADDRESS.COM>,bayes=0.499179672783929,autolearn=no
Mar 27 09:31:01 inside spamd[15950]: prefork: child states: II
Mar 27 09:31:01 inside postfix/pipe[16019]: 396F5BD61: 
to=<INSIDE at LOCAL.COM>, relay=spamassassin, delay=0.72, 
delays=0.31/0.01/0/0.4
, dsn=2.0.0, status=sent (delivered via spamassassin service)


Thanks,

Ben