One of the other recent errors I noticed in my LogWatch reports, other than the spam spike, was a weird error with cron reporting the grandchild had exited with a non-zero exit code. When I first saw it, it coincided with the spike in spam, so I had assumed it was logwatch timing out within cron whilst processing the log file. Now the spam level has died down, I noticed the error persisted…
For the record, here is what I am seeing in the logwatch reports on a daily basis…
--------------------- Cron Begin ------------------------
Errors when running cron:
grandchild #16016 failed with exit status 1: 1 Time(s)
grandchild #16606 failed with exit status 1: 1 Time(s)
Now it’s time to figure out what this process is, and fix it up. As I’m on a Debian box, cron logs to /var/log/syslog, so a quick grep of the logs, and this turned up:
grep "16016" syslog.0
Mar 3 21:33:01 rhea /USR/SBIN/CRON[16016]: (nobody) CMD ([ -x /usr/share/sa-exim/greylistclean ] && /usr/share/sa-exim/greylistclean)
Mar 3 21:33:01 rhea /USR/SBIN/CRON[16015]: (CRON) error (grandchild #16016 failed with exit status 1)
Ahh, for some reason, greylistclean process isn’t exiting properly. It struck me as odd that the path was sa-exim, I don’t use exim. So I did some verification with apt-file to see where it came from…
# apt-file update
# apt-file search greylistclean
sa-exim: /etc/cron.d/greylistclean
sa-exim: /usr/share/sa-exim/greylistclean
Sure enough, the file is in a package called sa-exim, and a quick lookup of the details says it’s for using SpamAssasin with Exim. As I don’t use Exim, I wondered why this was installed. I vaguely remember that Debian defaults to Exim on new system builds, and while I had removed it, for some reason this file was still floating around. What was odd was that I had removed all the Exim packages a long time back, even more odd, this was the first time I was seeing these errors from logwatch. A quick check from dpkg shows that the install wasn’t purged, so I went ahead and purged them…
# apt-get --purge remove sa-exim
File gone, now cron won’t complain.