I found /usr/local/psa/var/log/maillog files filled with the following error message on several servers with pyzor (and qmail-scanner) installed:



(Of course the process ID's vary.)

It seems the content of /var/spool/qscan/.pyzor/servers was outdated on these servers (I found 66.250.40.33:24441 and 82.94.255.100:24441 for instance), as running pyzor discover currently creates ~/.pyzor/servers as public.pyzor.org:24441.

Replacing the content of /var/spool/qscan/.pyzor/servers with public.pyzor.org:24441 seems to have helped.

Maybe this file should be automatically updated by running pyzor discover from a cronjob (as the qscand user in this case)?

I faced something similar very recently: servers was out of date on all my qmail-scanner machines. Not on others, however. My error message was different to yours -- but I don't remember what it was, I'm afraid.

Running pyzor discover (as root) caused some issues, however.

Firstly, I needed to add the pyzor_homedir=/path/to/servers in local.cf to make sure it could find the file and secondly I had to chmod servers to be readable by all as otherwise my error persisted.

Faris.

or maybe add that error message in as a specific HIDS event with some diagnostic info (Example: pyzor sources out of date, run pyzor discover)

Running 'pyzor discover' generates ~/.pyzor/servers, which in case of running the command as root generates /root/.pyzor/server. If pyzor is not run as root, then that file won't be read.

Just an update to this thread:

I happened to notice that I continued to get the pyzor terminated messages from time to time, even after checking that the servers file was in the right place and owned by the correct user (popuser in my case) and even though pyzor seemed to be working in general.

It turns out that I needed to increase the default timeour on pyzor. I set it to 20 seconds by adding pyzor_timeout 20 to local.cf

Faris.

According to http://spamassassin.apache.org/full/3.3 ... Pyzor.html the default value for pyzor_timeout is 3.5. Is that an unrealistically low setting? We're seeing messages like 'spamd[23163]: pyzor: [2378] error: TERMINATED, signal 15 (000f)' quite often in /var/log/psa/maillog as well and I'm wondering if it's normal that this timeout should be raised or if there could be other things to tweak.

I was just looking at this one today (in fact this thread is the #1 on google so... awesome). Anyway, I did a bunch of latency tests, most of them were under 2s, but I did get several over 15s. The only thing to really be aware of here is that it will add latency + pyzor_timeout to the overall processing and delivery time to the message.

Oh and also make sure you allow outbound TCP port 24441 to your firewall policy.

I opened a ticket with Pyzor to ask about the default timeout: https://sourceforge.net/apps/trac/pyzor/ticket/165