Milter-greylist

Scot,

     We have the same problem.  Messages somewhat regularly get through 
the edge servers without the greylist headers.

     To be fair, the edge servers run a pretty high load since they do 
sophos and spamassassin filtering.  There are 6 of them load balanced 
(also, using the mx sync feature) and they run a load average between 
3.0 and 8.0 for most of the day.

     I had just attributed it to the machines being overloaded so I've 
been concentrating more on provisioning more machines than on trying to 
debug.

Cheers,

~Ethan B.



Scot L. Harris wrote:
> Noticed today some unusual log entries from milter-greylist 1.4 and
> sendmail.
> 
> It appears that milter-greylist is writing entries to the log file out
> of order.  It also appears that the milter is timing out per the entries
> that sendmail is logging.  
> 
> Example below:
> 
> Jul 14 09:05:11 webserver sendmail[17140]: i6ED4vKP017140: Milter
> (greylist): timeout before data read
> Jul 14 09:05:17 webserver sendmail[17140]: i6ED4vKP017140: Milter
> (greylist): to error state
> Jul 14 09:05:02 webserver milter-greylist: i6ED4vKP017140: addr
> 218.165.213.230 from <roughshod0@...> to
> <aguirre@...> delayed for 00:02:00
> Jul 14 09:05:28 webserver sendmail[17140]: i6ED4vKP017140: lost input
> channel from 218-165-213-230.dynamic.hinet.net [218.165.213.230] to MTA
> after rcpt
> Jul 14 09:05:45 webserver sendmail[17140]: i6ED4vKP017140:
> from=<roughshod0@...>, size=0, class=0, nrcpts=1, proto=SMTP,
> daemon=MTA, relay=218-165-213-230.dynamic.hinet.net [218.165.213.230]
> 
> 
> The order above is as I found the records in the log file.  It looks
> like for some reason milter-greylist was delayed in writing an entry to
> the maillog file which resulted in sendmail writing the timeout info and
> error state messages then when milter-greylist was freed up it wrote the
> record that was pending.  
> 
> What is interesting is that the milter seems to grey list the message
> but I have had a number of messages drop on through without the
> milter-greylist headers.  Again this indicates to me that sendmail went
> ahead and accepted the connection and subsequently milter-greylist
> finished its activity after the fact.
> 
> At the time this seemed to occur the load average was at about 3 or so
> and it appeared we were receiving a large number of messages during that
> time.
> 
> The messages that seemed to get through the greylist without delay were
> subsequently caught by spamassassin.
> 
> Is this something that has been seen before?  Is there additional debug
> data that I can access?
> 
> Could the fact that I have a 2 minute delay cause this behavior?  Does
> this change the update period for the database file which is causing
> milter-greylist to exceed a timeout for sendmail?  Been running this way
> for several days and we seem to get all the benefits of greylisting.   
> 
> Any help would be appreciated.
> 
> Other than this anomaly this milter has been working wonders blocking
> spam.
> 
>