> > We're using syslog-ng 1.6.0rc3 and Perl 5.6.1 and SA 3 > RC1, and have found that the following sequence will cause a > spamd fork bomb: > > 1. Using the RH init script, start spamd (-d -x -u mail -D) > 2. Restart syslog-ng. > 3. Attempt to stop spamd with the RH init script. > > At this point the system becomes a spamd fork bomb. We > didn't see this with SA 2.6. > > Is one of our packages (syslog-ng or perl) out of date? > Or is this a real spamd bug? >
This is a spamd bug. I reported it over a month ago when SA3 was in pre2.. I'm sure it was introduced when they moved to preforking spamd. For more info, see http://bugzilla.spamassassin.org/show_bug.cgi?id=3625 This stopped mail processing on 3 of my boxes when that occurred. And you cant just stop spamd. You have to kill the parent and all child processes 1 by 1. In order to avoid this problem with spamd, I change my log facility to none. # spamd --syslog-socket=none -r /var/run/spamd.pid -q -x -m4 --max-conn-per-child 25 And by logging via daemontools, my STDOUT/STDERR all go through /var/log/spamd/current instead of maillog now. Not a big deal to me... Dallas
