Dallas,
Thanks for the confirmation. I've updated the bug with my
experience as well.
Chris
-----Original Message-----
From: Dallas L. Engelken [mailto:[EMAIL PROTECTED]
Sent: Tuesday, August 24, 2004 7:25 AM
To: [email protected]
Subject: RE: SA3: Spamd forkbomb after syslog-ng restart?
>
> We're using syslog-ng 1.6.0rc3 and Perl 5.6.1 and SA 3 RC1, and have
> found that the following sequence will cause a spamd fork bomb:
>
> 1. Using the RH init script, start spamd (-d -x -u mail -D) 2.
> Restart syslog-ng.
> 3. Attempt to stop spamd with the RH init script.
>
> At this point the system becomes a spamd fork bomb. We didn't see
> this with SA 2.6.
>
> Is one of our packages (syslog-ng or perl) out of date?
> Or is this a real spamd bug?
>
This is a spamd bug. I reported it over a month ago when SA3 was in pre2..
I'm sure it was introduced when they moved to preforking spamd.
For more info, see
http://bugzilla.spamassassin.org/show_bug.cgi?id=3625
This stopped mail processing on 3 of my boxes when that occurred. And you
cant just stop spamd. You have to kill the parent and all child processes 1
by 1.
In order to avoid this problem with spamd, I change my log facility to none.
# spamd --syslog-socket=none -r /var/run/spamd.pid -q -x -m4
--max-conn-per-child 25
And by logging via daemontools, my STDOUT/STDERR all go through
/var/log/spamd/current instead of maillog now. Not a big deal to me...
Dallas
