>On Thu, 5 Dec 2019 17:07:05 +0100
>Matus UHLAR - fantomas wrote:
>>seems some big mails were too long to scan, and SA even got killed.
>>
>>[2146809.213586] Out of memory: Kill process 3660 (spamassassin)
>>score 365 or sacrifice child [2146809.213613] Killed process 3660
>>(spamassassin) total-vm:2960664kB, anon-rss:2921892kB, file-rss:0kB,
>>shmem-rss:0kB [2146809.270342] oom_reaper: reaped process 3660
>>(spamassassin), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
>>
>>I see the mail body contains nearly 20MB uuencoded text (don't ask).
On 05.12.19 17:21, RW wrote:
>In rawbody rules the text is broken into chunks of 1024 to 2048 bytes,
>so the worst case isn't all that much worst than with {0,1000}.
>
>Also /m means that .* wont cross a line boundary in the decoded text
>and ^ can match in the middle of the chunk. This make the average
>processing time less sensitive to any upper limit on .*.
On Fri, Dec 06, 2019 at 10:23:15AM +0100, Matus UHLAR - fantomas wrote:
so it is not the quantifiers who cause SA taking too much of memory?
any idea how to debug that?
On 06.12.19 13:16, Henrik K wrote:
Scanning a generic 20MB will normally eat ~700MB memory. 3GB implies
something is bugging. Feel free to send a sample if you can.
I'm afraid I can't provide clients' file.
I can only repeat:
- the mail is 20424329 bytes
- the mail contains single uuencoded .rar file inline.
-rw-rw-rw- 1 root root 14818832 Dec 9 10:50 'redacted.rar'
I have tried to run it again, it took about 20minutes to scan and memory
usage slowly increased up to:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1924 amavis 20 0 3916332 2.8g 1468 D 1.0 72.2 3:08.08 spamassassin
note the "amavis" is the spamassassin command line client running under
amavis user to use amavis' bayes database:
amavis 1924 24.8 72.9 3916332 2923964 ? D 10:23 3:08 /usr/bin/perl
-T -w /usr/bin/spamassassin -x
-rw------- 1 amavis amavis 10584064 Dec 9 10:45 bayes_seen
-rw------- 1 amavis amavis 10760192 Dec 9 10:45 bayes_toks
I have tried to attach the proces using strace, after a while it produced
output (only 2 rules hit), and exited. I hope this didn't cause premature
exit of the SA client.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
How does cat play with mouse? cat /dev/mouse
