On Mon, Jul 12, 2004 at 02:53:01PM +0000, Tim Philip wrote:
> > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
> >21539 nobody 15 0 359M 118M 220 D 0.0 15.7 5:53 0 spamd
OUTCH! >300M is really heavy footprint.
The only time something like that hit me, was a combination of
'endless' (unbounded?) pattern in a selfmade rule and
'large Mails' (I explicitely allowed 10M mails to be checked),
Check for any selfmade rules, that result in[1]:
(something)*
--------------^
instead of
(something){in,max}
------------------^^^^
and change the '*' into something with a reasonalble maximum length.
After fixing this, and allowing for only maximal 5M mails,
my spamd went down to 21M and is now after many new SARE-Rules
added near 30M each child. (It went to >50 <60 with the new
BIG bigeval, but then I changed to 'SURBL's).
Stucki
[1] Those unbounded Patterns can of course be something small
like a simple '.*' or as big as a long 'bracketed' rule
with an '*' at the end. Also a lot of different
'unfactorized' alternatives '(.1.|.2.|.....)?' and other
such 'complications' can bloat the spamd.
Every time a rule *possibly* needs to come back to a
'former state of affairs' to recheck something, a big
memory allocation is done and saved for a while...
And this 'multiplies' (or eponetiates?) with the length
of the checked mail, because it is seeh as a whole long
string (and not a number of lines!).
--
Christoph von Stuckrad * * |nickname |<[EMAIL PROTECTED]>\
Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-75 459|
Fachbereich Mathematik, EDV|\ *|if online|Tel(else):+49 30 77 39 6600|
Arnimallee 2-6/14195 Berlin* * |on IRCnet|Fax(alle):+49 30 838-75454/
