On 3/20/11 4:39 PM, Karsten Bräckelmann wrote:
On Sun, 2011-03-20 at 20:26 +0100, Sam wrote:
Some email on this list is crashing my spamassin daemon :
My server went down and I saw it was when spamd is starting to scan for
exemple the email from Matt Elson a few minutes ago.
Yes. Please see that full thread, in any archive of your choice. Or your
own email.
This appears to be a bug with re2c (using sa-compile) and some
combination of hardware architecture and/or OS. Bug 6558 [1].
not sure what it really is.. same hardware, same software, in freebsd
jail, some work, some don't.
it seems to work at command line, but guess what: when running it
doesn!!!
both of my hosts just gobbled up all the ram and swap, crashing mysql in
several jailed servers.
tampa:
PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
12464 vscan 1 118 0 20220M 4958M CPU2 2 392:41 100.00% perl
ps -auxwwp 12464
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
vscan 12464 100.0 20.2 20716804 5077632 ?? RJ 3:45PM 392:54.53
amavisd (ch2-12464-02) (perl)
Mar 20 22:35:40 tpa kernel: swap zone exhausted, increase kern.maxswzone
Mar 20 22:35:41 tpa kernel: pid 12464 (perl), uid 110, was killed: out
of swap space
Mar 20 22:29:21 mx3 amavis[12464]: (12464-02) (!)TempDir removal:
tempdir is to be PRESERVED: /var/amavis/tmp/amavis-20110320T154904-12464
bct:
PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
36404 vscan 1 118 0 3824M 3512M CPU6 6 66:45 100.00% perl
I assume its the same email. (but its for different clients)
ps -auxwwp 36404
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
vscan 36404 100.0 15.6 3916100 3600540 ?? RJ 8:41PM 67:43.50
amavisd (ch16-36404-16) (perl)
bct.ionspam.net#
or, its that __pill thing discussed earlier.
grep -36404-16 in maillog found nothing (-15, 14, yes) but -16, nothing.
mailq is empty.
killed it and now I have:
Mar 20 22:36:13 mx2 amavis[36404]: (36404-16) (!)TempDir removal:
tempdir is to be PRESERVED: /var/amavis/tmp/amavis-20110320T204510-36404
in var/amavis/tmp/amavis-* is the pill spam we saw earlier.
needs emergency sa-update now.
as per bug below, do this in your local.cf
meta __PILL_PRICE_1 (0)
meta __PILL_PRICE_2 (0)
meta __PILL_PRICE_3 (0)
[1] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6558
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Best Intrusion Prevention Product, Networks Product Guide
* Certified SNORT Integrator
* Hot Company Award, World Executive Alliance
* Best in Email Security, 2010 Network Products Guide
* King of Spam Filters, SC Magazine
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
