On Thu, 4 Dec 2003, Cheryl L. Southard wrote:
Hi All,
I've got two spamd processes that just wont go away. They've been running for well over 11 hours and are taking up 100% of my cpu.
One idea, there's something in the mail that particular user is getting that is triggering some kind of bug in SA (buffer overflow, etc). Can you find the offending message and try feeding it to SA by hand?
We've had very similar problems here. One or more spamd processes kept running and other spamd procs would pile up behind them until the machine was brought down. We are running with -m 15 so only 15 or so spamd children would fork, but other processes (sendmail, spamc, etc) eventually brought our system to it's knees.
After as much diagnostics as we could run (it's a production machine), we concluded that it's something in the Bayes DB and/or the message, as David suggests.
I was able to capture a message that caused the problem and sure enough, it caused spamassassin (run by hand) to hang up. I then removed all the custom rule sets one by one and eventually the message passed through spamassassin correctly (in less than a second). I then put the rule sets back in and it still passed through SA in less than a second. That led me to conclude that it's something in the Bayes DB that triggers a bug in SA. And during the time I was removing and then adding back the rule sets back in, that data had changed.
The symptom for spamd is that it is doing preads on the Bayes token file (bayes_toks) and seems to be stuck doing this in an infinite loop. I found this by running strace on a stuck spamd and lsof to determine the file from the file descriptor.
This happens on two very different systems with different versions of Perl, Berkeley DB and DB_File but the same version of SA (2.60).
Another idea, are you using Bayes, and if so do you not have bayes_learn_to_journal enabled?
We didn't have this enabled. In fact now we're running with Bayes disabled entirely. With the rule sets from Chris, Jennifer and Fred, we're not seeing any difference! No increase in FPs or FNs. (Thanks for all your collective work!)
I might try enabling the journal feature and trying Bayes again but if it's a data problem in the token database I don't think that will fix it.
Cheers,
Bob
--
Bob Amen
O'Reilly & Associates, Inc.
http://www.ora.com/
http://www.oreilly.com/------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
