headers
Joshua Megerman | 14 Oct 2011 15:43

Re: ripmime

> We're using simscan to call clamd and spamd, and lately (in the last
> week or so), we've been seeing a lot of these errors in the logs:
>
> Oct 14 04:02:15 mail kernel: [9781102.945747] ripmime[14308]: segfault at
> 18a085e8 ip 08054588 sp bff61530 error 4 in ripmime[8048000+1d000]
> Oct 14 04:02:41 mail kernel: [9781128.982628] ripmime[14585]: segfault at
> 18aca5e8 ip 08054588 sp bf8855a0 error 4 in ripmime[8048000+1d000]
> Oct 14 04:03:47 mail kernel: [9781195.177554] ripmime[15062]: segfault at
> 18ab65e8 ip 08054588 sp bff9f420 error 4 in ripmime[8048000+1d000]
> Oct 14 04:04:54 mail kernel: [9781261.239391] ripmime[15475]: segfault at
> 18aa75e8 ip 08054588 sp bfba78e0 error 4 in ripmime[8048000+1d000]
> Oct 14 04:06:00 mail kernel: [9781327.084212] ripmime[16041]: segfault at
> 1898b5e8 ip 08054588 sp bfb065a0 error 4 in ripmime[8048000+1d000]
> Oct 14 04:07:06 mail kernel: [9781393.238548] ripmime[16732]: segfault at
> 18ab45e8 ip 08054588 sp bf8a2770 error 4 in ripmime[8048000+1d000]
> Oct 14 04:07:32 mail kernel: [9781419.179641] ripmime[17072]: segfault at
> 18a815e8 ip 08054588 sp bffa3820 error 4 in ripmime[8048000+1d000]
>
> The ripmime version is v1.4.0.9 and it is running on Ubuntu 10.04.3.
>
> Does anyone have an idea of what may be causing this?
>
Try upping your softlimit for qmail-smtpd.  I don't remember if I've seen
segfaults from it being to low, but I've definitely seen scan failures,
and as clamav and spamassassin have gotten more complicated, their memory
footprints have grown somewhat.  If that doesn't help, try reinstalling
ripmime and/or and libraries it depends on ('ldd /path/to/ripmime' and go
from there).

Josh
(Continue reading)

Permalink | Reply |
headers
Trey Nolen | 14 Oct 2011 16:00
Favicon

Re: ripmime


On 10/14/2011 08:43 AM, Joshua Megerman wrote:
>> We're using simscan to call clamd and spamd, and lately (in the last
>> week or so), we've been seeing a lot of these errors in the logs:
>>
>> Oct 14 04:02:15 mail kernel: [9781102.945747] ripmime[14308]: segfault at
>> 18a085e8 ip 08054588 sp bff61530 error 4 in ripmime[8048000+1d000]
>> Oct 14 04:02:41 mail kernel: [9781128.982628] ripmime[14585]: segfault at
>> 18aca5e8 ip 08054588 sp bf8855a0 error 4 in ripmime[8048000+1d000]
>> Oct 14 04:03:47 mail kernel: [9781195.177554] ripmime[15062]: segfault at
>> 18ab65e8 ip 08054588 sp bff9f420 error 4 in ripmime[8048000+1d000]
>> Oct 14 04:04:54 mail kernel: [9781261.239391] ripmime[15475]: segfault at
>> 18aa75e8 ip 08054588 sp bfba78e0 error 4 in ripmime[8048000+1d000]
>> Oct 14 04:06:00 mail kernel: [9781327.084212] ripmime[16041]: segfault at
>> 1898b5e8 ip 08054588 sp bfb065a0 error 4 in ripmime[8048000+1d000]
>> Oct 14 04:07:06 mail kernel: [9781393.238548] ripmime[16732]: segfault at
>> 18ab45e8 ip 08054588 sp bf8a2770 error 4 in ripmime[8048000+1d000]
>> Oct 14 04:07:32 mail kernel: [9781419.179641] ripmime[17072]: segfault at
>> 18a815e8 ip 08054588 sp bffa3820 error 4 in ripmime[8048000+1d000]
>>
>> The ripmime version is v1.4.0.9 and it is running on Ubuntu 10.04.3.
>>
>> Does anyone have an idea of what may be causing this?
>>
> Try upping your softlimit for qmail-smtpd.  I don't remember if I've seen
> segfaults from it being to low, but I've definitely seen scan failures,
> and as clamav and spamassassin have gotten more complicated, their memory
> footprints have grown somewhat.  If that doesn't help, try reinstalling
> ripmime and/or and libraries it depends on ('ldd /path/to/ripmime' and go
> from there).
(Continue reading)

Permalink | Reply |
headers
Joshua Megerman | 14 Oct 2011 16:39

Re: ripmime

>> Try upping your softlimit for qmail-smtpd.  I don't remember if I've
>> seen
>> segfaults from it being to low, but I've definitely seen scan failures,
>> and as clamav and spamassassin have gotten more complicated, their
>> memory
>> footprints have grown somewhat.  If that doesn't help, try reinstalling
>> ripmime and/or and libraries it depends on ('ldd /path/to/ripmime' and
>> go
>> from there).
>>
> I thought that might be the issue, too, so we temporarily removed all
> softlimits on qmail.   We are still seeing the same issue.  Could there
> be a limit on ripmime itself that I'm not aware of?  Or clamd?
>
The only thing I can suggest is that you try running qmail-smtpd via
strace, although this might break simscan anyway (I know it used to break
qscanq when I used that, I can't remember if I've done it since I switched
to simscan).  Just insert '/usr/bin/strace -o/tmp/smtp.log -ff' before the
call to qmail-smtpd in your run file (substitute paths as needed) and then
try to send email - you'll get a metric buttload of logging (one file per
process, named /tmp/smtp.log.<PID>) that should hopefully let you see
where it's blowing up.  I just recommend doing it on a non-production port
so you don't end up messing up real mail :)

If that doesn't work, I'm out of ideas.

Josh

Joshua Megerman
SJGames MIB #5273 - OGRE AI Testing Division
(Continue reading)

Permalink | Reply |
headers
Trey Nolen | 14 Oct 2011 17:19
Favicon

Re: ripmime


On 10/14/2011 09:39 AM, Joshua Megerman wrote:
>>> Try upping your softlimit for qmail-smtpd.  I don't remember if I've
>>> seen
>>> segfaults from it being to low, but I've definitely seen scan failures,
>>> and as clamav and spamassassin have gotten more complicated, their
>>> memory
>>> footprints have grown somewhat.  If that doesn't help, try reinstalling
>>> ripmime and/or and libraries it depends on ('ldd /path/to/ripmime' and
>>> go
>>> from there).
>>>
>> I thought that might be the issue, too, so we temporarily removed all
>> softlimits on qmail.   We are still seeing the same issue.  Could there
>> be a limit on ripmime itself that I'm not aware of?  Or clamd?
>>
> The only thing I can suggest is that you try running qmail-smtpd via
> strace, although this might break simscan anyway (I know it used to break
> qscanq when I used that, I can't remember if I've done it since I switched
> to simscan).  Just insert '/usr/bin/strace -o/tmp/smtp.log -ff' before the
> call to qmail-smtpd in your run file (substitute paths as needed) and then
> try to send email - you'll get a metric buttload of logging (one file per
> process, named /tmp/smtp.log.<PID>) that should hopefully let you see
> where it's blowing up.  I just recommend doing it on a non-production port
> so you don't end up messing up real mail :)
>
> If that doesn't work, I'm out of ideas.
>

The problem with that is that only some emails are triggering this
(Continue reading)

Permalink | Reply |

Gmane