On Mon, Dec 09, 2019 at 10:54:00AM +0100, Matus UHLAR - fantomas wrote:
I'm afraid I can't provide clients' file.

I can only repeat:
- the mail is 20424329 bytes
- the mail contains single uuencoded .rar file inline.

-rw-rw-rw- 1 root root 14818832 Dec  9 10:50 'redacted.rar'

I have tried to run it again, it took about 20minutes to scan and memory
usage slowly increased up to:

 PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
1924 amavis    20   0 3916332   2.8g   1468 D   1.0  72.2   3:08.08 spamassassin

note the "amavis" is the spamassassin command line client running under
amavis user to use amavis' bayes database:

amavis    1924 24.8 72.9 3916332 2923964 ?     D    10:23   3:08 /usr/bin/perl 
-T -w /usr/bin/spamassassin -x

-rw------- 1 amavis amavis 10584064 Dec  9 10:45 bayes_seen
-rw------- 1 amavis amavis 10760192 Dec  9 10:45 bayes_toks

I have tried to attach the proces using strace, after a while it produced
output (only 2 rules hit), and exited.  I hope this didn't cause premature
exit of the SA client.

On 09.12.19 12:07, Henrik K wrote:
And what does running spamassassin debug directly from command line output?
Where does it hang?

spamassassin -t -D < message >/dev/null

hmmm, the machine has 4G of RAM and SA now takes 4.5. The check rund out of time but produces ~450K debug file.

This is where it hangs:

Dec 10 17:43:51.727 [9721] dbg: bayes: tokenized header: 211 tokens
Dec 10 17:50:16.111 [9721] info: check: exceeded time limit in 
Mail::SpamAssassin::Plugin::Check::_eval_tests_type11_prineg90_set3, skipping 
further tests

I guess it's just the slowness of bayes checking (haven't tried redis)

but It still doesn't explain why it takes that much RAM, does it?

I can try on machine with more RAM, hopefully it'll help.

--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Silvester Stallone: Father of the RISC concept.

Reply via email to