spamd: Cannot open bayes database and high CPU usage

[breun]

On a Project Gamera box I see this message a lot in /var/log/maillog:

spamd[6030]: bayes: cannot open bayes databases /var/spool/qscan/.spamassassin/bayes_* R/W: lock failed: File exists

/var/spool/qscan is owned by qscand:qscand and 775
/var/spool/qscan/.spamassassin is owned by qscand:qscand and 700

/var/spool/qscan/.spamassassin contains the following files:

total 293440
-rw------- 1 qscand qscand 168046592 Sep 9 17:05 auto-whitelist
-rw------- 1 qscand qscand 4320 Sep 9 17:05 bayes_journal
-rw------- 1 qscand qscand 24 Sep 9 17:03 bayes.lock
-rw------- 1 qscand qscand 41885696 Sep 9 16:33 bayes_seen
-rw------- 1 qscand qscand 168013824 Sep 9 17:03 bayes_toks
-rw------- 1 qscand qscand 94208 Apr 12 00:00 bayes_toks.expire10869
-rw------- 1 qscand qscand 90112 Apr 11 23:32 bayes_toks.expire18196
-rw-r--r-- 1 qscand qscand 1487 Dec 20 2007 user_prefs

spamd processes are frequently using nearly 100% CPU on this box. I don't see spamd using that much CPU on other boxes and I also don't see those lock failed messages on other boxes.

Any suggestions?

[scott]

CPU /ram problems maybe?

[laughingbuddha]

Hey breun, what did the problem turn out to be. I've recently been receiving the same error.

Me fear is that this is my only server, I do run RAID but not sure how to remove a faulty drive, or indeed find out which on is fault on my HP Proliant DL360

Thanks,

Matt

[breun]

Hey breun, what did the problem turn out to be. I've recently been receiving the same error.

I really don't remember. I don't think I ever did anything to solve this.

Me fear is that this is my only server, I do run RAID but not sure how to remove a faulty drive, or indeed find out which on is fault on my HP Proliant DL360

I don't think this error message has anything to do with faulty drives. Apart from that: I don't know your RAID setup, but your RAID tools should be able to tell you the status of the array.

(And of course you're making backups regularly, right?)

[laughingbuddha]

Urmmm....yessss......when I mean yes I me no.

Sadly funds haven't allowed me to arrange a back up service or software, and as I'm a Linux newbie I have no idea what I'm doing on CentOS. I'm not sure how to configure the resync to send stuff to my home server.

As I'm currently developing my web start-up I have neither the time hunt down a forum thread to learn, or the money to pay someone to set it up.

I'll run some diags on the drives tomorrow at midnight, as my co-lo provider wants to move the server to a new rack, so it'll be down anyway.

Matt

[breun]

Just remember RAID is not backup. And your RAID dying when you don't have any backups might mean your startup dying, so I wouldn't think too lightly about doing backups.

[laughingbuddha]

In defence for my back-ups, I do hold all the sites locally on my computer, as I develop them, only the databases don't get regular back-up.

And RAID is redundent. RAID 1 (or Mirror RAID) is a form of back-up, where one drive becomes a redundent copy of the other. I've repaired/replace faulty RAID drives in the past, just not on a Linux based system.

I've considered dumping Linux in favour of Windows as I'm more in my eliment on a Microsoft platform.

Matt

[breun]

I know what RAID-1 is, but RAID is not backup. RAID-1 protects against one drive failing (which is great of course), but if files get deleted or corrupted running RAID-1 won't help anything at all. The files will just be unusable on both drives in the mirror. Doing backups is also about being able to go back in time, so you can roll back to how things were before a problem started.

I suggest not relying RAID-1 alone, or expect to get bitten at some point.

Keeping copies of your websites is a starting point. I suggest at least adding regular database dumps to your routine and storing them offline as well. That way you can at least restore to some point in time, even on another server if needed, when things go wrong.

[laughingbuddha]

I did look at resync but got confused by the commands, and found very little online aimed at newbies. This seems to be the case in most issues I have on Linux, posts bang out commands but forget that not everyone is a linux guru.

I would also consider upgrading to Plesk 9 from 8.6, but as this is my only production server at present, I don't have a back-up box to take over if (and more to the point when) something goes wrong.

Matt

[biggles]

I've considered dumping Linux in favour of Windows as I'm more in my eliment on a Microsoft platform.

Matt

Don't DO it!!!

Backing up in Plesk is acutally pretty easy. One way is using one of the rsync scripts flying around out there. For backups I didn't go that way. Instead I bought 4BSA Backup for $99 and everything is easily handled within Plesk CP. You just need ftp storage space somewhere.

And Raid-1 isn't anywhere in the neigberhood of backup. Sure, replacing a failed disk saves you, but what about a failed controller? Or both harddrives dying within hours (days?) of eachother? When you have disks from the same manufacturer and maybe even the same batch the statistics isnät really on your side... I am keeping local daily backups of all my server and databases and one backup per week off site.

[Galactic Zero]

If you want to backup your MySQL databases locally or even just work with them directly from your desktop to the server check out Navicat:
http://www.navicat.com/en/products/navi ... rview.html

Besides being able to backup on the local server it can also backup to a remote server. It also gives you a nice tool to manipulate the databases without having to use the servers database admin tool.

So backing up using the pleskbackup tool and keeping copies of your data on local computers is good. One thing that would not get backed up are the settings etc you have setup for the server unless you're very meticulous about keeping the config files local.

Raid 1 (mirrored pair drives) is good for reduncancy, Raid 5 (3+ drives) in a stripped set gives you redundancy with speed. However, like others have said, a raid configuration is no replacement for a solid backup. Just schedule a cron job to run pleskbackup from a script then setup another job to ftp the files to your local computer.

As for dumping Linux in favor of MS Web Server, DON"T DO IT. I'm a MS professional and have my own IT services business. I won't put up a Windows Web server for any of my clients unless they are willing to pay triple for the service. MS has a big target on their collective backs for hackers. You'd spend more time and effort trying to keep your server secure than doing web development. Linux is much more stable and reliable also, proven track record.

Just my 2cents, not worth much nowadays.

[laughingbuddha]

I had considered 4PSA, but the problem with that is you need 4PSA to back up, then then 4PSA on the new server to restore. I would asume paying for yet another licence to do the restore.

I think Plesk Back-up is a seperate licence with Plesk. I'm only running 8.6 and have heard the old Plesk Back-up isn't very good, is that true?

I'm not 100% sure on how to write cron job commands in root, and to be honest I can only just about navigate through root via SHH and view/edit config and log files, something I also don't do often unless I'm running yum update, asl -u or asl -s -f

That's about it really. When I say newbie, I'm not kidding.

[Galactic Zero]

Don't be afraid of shell, it's like windows CMD program. You can edit with vi, old school, but there are other more friendly editors. Making a cron job is easy, just create a new file in the /etc/crond.XXX directory and the system typically runs it automatically. XXX=schedule.

Here is the contents of my sa_update file in cron.daily

/usr/bin/sa-update --allowplugins \
--channel updates.spamassassin.org \
#--gpgkey D1C035168C1EBC08464946DA258CDB3ABDE9DC10 --channel saupdates.openprotect.com, \
#&& /sbin/service spamassassin restart > /dev/null 2>&1 | tee -a /var/log/sa-update.log

Just enter the command for your backup program with all the switches you want and put it in the cron.daily cron.weekly etc dir that you want this job to run.

As for the backup program in Plesk 8.6, it will do a fine job, I've extracted various domains out of them without issues. If you don't want to try and run a cron job to ftp the files to your local box, just remember to pull them down yourself. Typically putting them in /home/admin will allow you to use the admin id / pw for the server to enter that directory and pull down your backup.

There is alot of information on this site and on swsoft's site to help with all these tasks. I'm sure if you did a search you'd be able to find a script to do what you want with ease.

[biggles]

I had considered 4PSA, but the problem with that is you need 4PSA to back up, then then 4PSA on the new server to restore. I would asume paying for yet another licence to do the restore.

You can restore with 4PSA command line tool , which you can execute before installing license, or with normal tar command. It is all pretty well documented in their documentation.

But as Frank says, Plesk backup is also a possibility.

And please hang in there. After a while everthing starts to fall into place. and from what I have seen in the forums, you are way more into it then most of the Linux admins you meet on the net.

[laughingbuddha]

Thanks for your support guys. It has been a pain of a week (clients wasting my time) and I was on a bit of a stressed out downer.

Well I was at the data center last night till 1.30am (http://www.twitter.com/mattauckland) and after we moved the server to its new rack, it appears that the primary drive in the RAID set is failing according to the controller. Luckly they're only 147GB Fujitsu SCSI drives, so hopefully it won't be too pricey. Funny thing is, because I pulled the drive out to get its model number then put it back in, the RAID controller thought it was a new drive and began to rebuild it.....hummmm, have to wait and see how that turns out.

I've considered my options, and after re-visiting 4PSA's website I've found the price for there back-up solution is cheaper than it was, that and the current pound to euro convertion is in my favour, so I will opt for that I think.

As for thinking of upgrading from 8.6 to Plesk 9, I'm going to stick with 8.6 as its my only live production server and I don't want to screw it up.

Thanks again guys!