Re: [sa-list] dccifd errors (connection closed/broken pipe caused by shortcircuits)

On Wed, 8 Oct 2025, Matija Nalis wrote:

> Is dccifd even running?

Yes.  Because it's producing these logs when SA disconnects.  These are 
dccifd logs, not spamd logs.

> If so, and it doesn't produce any logs of its
> own, I'd do "strace -ff -tt -p `pidof dccifd`" to try to see where it fails

dccifd is producing *these* logs.

What I am pretty sure is happening is that we have the "shortcircuit" 
plugin installed, and so if a shortcircuit=spam fires, it hangs up on 
dccifd without properly closing the connection.

Any ideas as to how to tell SA not to shortcircuit this, or how to close 
the dccifd connection in a more clean way?

(Note: our chain is postfix --> spamass-milter --> spamc --> spamd --> 
dccifd)

Here are some logs that correlate this (look at the times)

root@post:/var/log # bzcat maillog.1.bz2 | grep shortcircuit=spam

Oct  9 07:25:43 post spamd[15574]: spamd: result: Y 111 - 
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,URIBL_CSS_A,URIBL_DBL_SPAM 
scantime=0.1,size=15312,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=16731,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam 
Oct  9 07:25:43 post spamd[15575]: spamd: result: Y 114 - 
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,URIBL_CSS_A,URIBL_DBL_SPAM,URIBL_ZRD 
scantime=0.1,size=15297,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=45408,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam 
Oct  9 07:25:43 post spamd[15574]: spamd: result: Y 114 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,URIBL_CSS_A,URIBL_DBL_SPAM,URIBL_ZRD 
scantime=0.1,size=15252,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=15343,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam 
Oct  9 11:02:01 post spamd[19633]: spamd: result: Y 119 - 
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SH_DBL_HEADERS,SPF_HELO_NONE,SPF_PASS,URIBL_BLACK,URIBL_DBL_SPAM 
scantime=0.1,size=6408,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=49587,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam 
Oct  9 14:14:31 post spamd[21403]: spamd: result: Y 122 - 
ARC_SIGNED,ARC_VALID,DCC_CHECK,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SH_DBL_HEADERS,SH_HELO_DBL,SPF_HELO_NONE,SPF_PASS,URIBL_CSS_A,URIBL_DBL_SPAM 
scantime=1.9,size=13920,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=51870,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam 
Oct  9 15:13:23 post spamd[22657]: spamd: result: Y 112 - 
ARC_SIGNED,ARC_VALID,DCC_CHECK,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_HOSTKARMA_BL,RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SPF_HELO_NONE,SPF_PASS,URIBL_ABUSE_SURBL,URIBL_BLACK,URIBL_CSS_A 
scantime=1.8,size=18031,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=46568,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct  9 17:33:56 post spamd[24144]: spamd: result: Y 116 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SH_DBL_HEADERS,SPF_HELO_NONE,SPF_PASS,URIBL_CSS_A,URIBL_DBL_SPAM
scantime=0.1,size=16734,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=37243,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct  9 20:29:25 post spamd[25497]: spamd: result: Y 108 - 
DCC_CHECK,RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_XBL,RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SPF_HELO_SOFTFAIL,SPF_SOFTFAIL
scantime=1.5,size=4500,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=31880,mid=<[email protected]>,autolearn=disabled,shortcircuit=spam
Oct  9 20:44:40 post spamd[25497]: spamd: result: Y 114 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SPF_HELO_NONE,SPF_PASS,URIBL_DBL_ABUSE_PHISH,URIBL_DBL_PHISH
scantime=0.1,size=21506,user=xxxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=28473,mid=<8as9v5vaS6GVCwWHd_SB4A@geopod-ismtpd-36>,autolearn=disabled,shortcircuit=spam
Oct  9 20:44:51 post spamd[25497]: spamd: result: Y 105 -
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT
scantime=0.1,size=21420,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=49326,mid=<3RSz7P7CRjWuVuHqWVWO9A@geopod-ismtpd-2>,autolearn=disabled,shortcircuit=spam
Oct  9 20:45:04 post spamd[25497]: spamd: result: Y 111 - 
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,URIBL_DBL_PHISH,URIBL_GREY 
scantime=0.1,size=21257,user=xxx,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=61028,mid=<TYwjFL6OR2WpClDiLD-EeA@geopod-ismtpd-13>,autolearn=disabled,shortcircuit=spam
Oct  9 20:45:42 post spamd[25497]: spamd: result: Y 114 - 
RCVD_IN_ZEN_LASTEXTERNAL,SHORTCIRCUIT,SPF_HELO_NONE,SPF_PASS,URIBL_DBL_ABUSE_PHISH,URIBL_DBL_PHISH 
scantime=0.1,size=21867,user=cathy_almond,uid=58,required_score=5.0,rhost=localhost,raddr=::1,rport=54166,mid=<6DFxvdpzTd2qixRVEvOnaQ@geopod-ismtpd-25>,autolearn=disabled,shortcircuit=spam

root@post:/var/log # bzcat maillog.1.bz2 | grep dccifd 
Oct  9 00:00:00 post dccifd[834]: 2.3.168 detected 0 spam, ignored for 0,
rejected for 0, and discarded for 0 targets among 0 total messages for
3225 targets since 10/08/25 00:00:00
Oct  9 07:25:43 post dccifd[834]: write(MTA socket,820): Broken pipe
Oct  9 07:25:43 post dccifd[834]: write(MTA socket,820): Broken pipe 
Oct  9 07:25:43 post dccifd[834]: write(MTA socket,822): Broken pipe
Oct  9 11:02:02 post dccifd[834]: write(MTA socket,843): Broken pipe
Oct  9 17:33:56 post dccifd[834]: write(MTA socket,840): Broken pipe
Oct  9 20:44:41 post dccifd[834]: write(MTA socket,840): Broken pipe
Oct  9 20:44:51 post dccifd[834]: write(MTA socket,840): Broken pipe
Oct  9 20:45:05 post dccifd[834]: write(MTA socket,840): Broken pipe
Oct  9 20:45:43 post dccifd[834]: write(MTA socket,840): Broken pipe



-Dan

-- 

--------Dan Mahoney--------
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
FB:  fb.com/DanielMahoneyIV
LI:   linkedin.com/in/gushi
Site:  http://www.gushi.org
---------------------------