has become a critical issue. was: Email on this list crashing my server

[Michael Scheidell <mi...@secnap.com>]

On 3/20/11 4:39 PM, Karsten Bräckelmann wrote:
> On Sun, 2011-03-20 at 20:26 +0100, Sam wrote:
>> Some email on this list is crashing my spamassin daemon :
>>
>> My server went down and I saw it was when spamd is starting to scan for
>> exemple the email from Matt Elson a few minutes ago.
> Yes. Please see that full thread, in any archive of your choice. Or your
> own email.
>
> This appears to be a bug with re2c (using sa-compile) and some
> combination of hardware architecture and/or OS. Bug 6558 [1].
>
not sure what it really is.. same hardware, same software, in freebsd 
jail, some work, some don't.
it seems to work at command line, but guess what:    when running it 
doesn!!!

both of my hosts just gobbled up all the ram and swap, crashing mysql in 
several jailed servers.

tampa:

   PID USERNAME   THR PRI NICE   SIZE    RES STATE   C   TIME   WCPU COMMAND
12464 vscan        1 118    0 20220M  4958M CPU2    2 392:41 100.00% perl

  ps -auxwwp 12464
USER    PID %CPU %MEM   VSZ   RSS  TT  STAT STARTED      TIME COMMAND
vscan 12464 100.0 20.2 20716804 5077632  ??  RJ    3:45PM 392:54.53 
amavisd (ch2-12464-02) (perl)


Mar 20 22:35:40 tpa kernel: swap zone exhausted, increase kern.maxswzone
Mar 20 22:35:41 tpa kernel: pid 12464 (perl), uid 110, was killed: out 
of swap space

Mar 20 22:29:21 mx3 amavis[12464]: (12464-02) (!)TempDir removal: 
tempdir is to be PRESERVED: /var/amavis/tmp/amavis-20110320T154904-12464

bct:


   PID USERNAME  THR PRI NICE   SIZE    RES STATE   C   TIME   WCPU COMMAND
36404 vscan       1 118    0  3824M  3512M CPU6    6  66:45 100.00% perl


I assume its the same email. (but its for different clients)

ps -auxwwp 36404
USER    PID %CPU %MEM   VSZ   RSS  TT  STAT STARTED      TIME COMMAND
vscan 36404 100.0 15.6 3916100 3600540  ??  RJ    8:41PM  67:43.50 
amavisd (ch16-36404-16) (perl)
bct.ionspam.net#

or, its that __pill thing discussed earlier.

grep -36404-16 in maillog found nothing (-15, 14, yes) but -16, nothing.

mailq is empty.

killed it and now I have:

Mar 20 22:36:13 mx2 amavis[36404]: (36404-16) (!)TempDir removal: 
tempdir is to be PRESERVED: /var/amavis/tmp/amavis-20110320T204510-36404

in var/amavis/tmp/amavis-*  is the pill spam we saw earlier.

needs emergency sa-update now.

as per bug below, do this in your local.cf

meta __PILL_PRICE_1  (0)
meta __PILL_PRICE_2  (0)
meta __PILL_PRICE_3  (0)



> [1] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6558
>


-- 
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
 >*| *SECNAP Network Security Corporation

    * Best Intrusion Prevention Product, Networks Product Guide
    * Certified SNORT Integrator
    * Hot Company Award, World Executive Alliance
    * Best in Email Security, 2010 Network Products Guide
    * King of Spam Filters, SC Magazine


______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________