-- Ian G Batten said the following on 9/3/07 10:50 AM:
> On 30 Aug 2007, at 21:40, [EMAIL PROTECTED] wrote:
>
>> On Thu, 30 Aug 2007, [EMAIL PROTECTED] wrote:
>>
>>> I'm noticing hang issues again with 0.91.2 on Solaris 10 x86. It
>>> doesn't
>>> appear to be associated with a particularly malformed message because
>>> when it starts hanging, if I restart it, things resume normally for a
>>> while. The incoming queue clears out.
>> Here's some more.
>>
>> [Switching to Thread 1 (LWP 1)]
>> 0xfebf0857 in _so_accept () from /lib/libc.so.1
>> (gdb) thread apply all bt
>>
>> Thread 22 (Thread 39 ):
>> #0 0xfebf047b in __lwp_park () from /lib/libc.so.1
>> #1 0xfebe9463 in mutex_lock_queue () from /lib/libc.so.1
>> #2 0xfebe9cff in slow_lock () from /lib/libc.so.1
>> #3 0xfebe9df5 in mutex_lock_impl () from /lib/libc.so.1
>> #4 0xfebe9f01 in pthread_mutex_lock () from /lib/libc.so.1
>> #5 0xfeb92f1d in malloc () from /lib/libc.so.1
>> #6 0xfebb400d in match_re_C () from /lib/libc.so.1
>> #7 0xfebb50e2 in match_re_C () from /lib/libc.so.1
>> #8 0xfebb5359 in match_re_C () from /lib/libc.so.1
>
> Same problem I saw. The regexp built by the PhishingScanURLs option
> appears to upset the Solaris regexp library, but not the Linux or OSX
> versions. I've got a more serious look at the problem on my list of
> jobs to do, but for now I just turned the option off.
I'm not sure why, but when I commented out the qr'^MAIL$' below, the
problem went away. Hasn't reappeared since. Perhaps that option is only
called when the full message is scanned? How are you calling clamd?
@keep_decoded_original_maps = (new_RE(
qr'^MAIL$', # retain full original message
qr'^MAIL-UNDECIPHERABLE$',
qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
# qr'^Zip archive data', # don't trust Archive::Zip
));
Since I'm using amavisd-new, as Bill Landry stated I could always try
$bypass_decode_parts=1 and leave the qr'^MAIL$' thing commented out. The
downside, though, is that I couldn't do attachment / file type blocking
using amavisd-new. So for now I have qr'^MAIL$' commented out and things
seem to be stable.
Amos
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
