I left debugging turned on when we went live with a new dspam relay
server, and this morning the dspam.messages file (which is a
concatenation of *all* messages received) reached 2GB in size and dspam
started to dump core anytime anyone did anything (including trying to
release messages from quarantine).
So, the important lessons for today:
1) Don't leave debugging active on a production server :(
2) If you do have debugging on for some reason, make sure that the
dspam.messages file stays < 2GB in size.
If you need to split the dspam.messages file into individual e-mail
messages so you can resend them (since releasing from quarantine would
error out and eat the message), you can use the following script:
#!/usr/bin/perl -w
# split dspam message log by message
my $startrx = qr/^Received: from [your relay server]/;
my $file = shift || die "pass in the filename, stupid";
open my $FILE, "<", $file;
my $count = 0;
open my $outfile, ">", "msgs/msg.$count";
while (<$FILE>) {
if ( $_ =~ $startrx ) {
close $outfile;
$count++;
open $outfile, ">", "msgs/msg.$count";
}
print $outfile $_;
}
close $outfile;
where [your relay server] is a regular expression which matches your
inbound MX servers. If you have dspam as the public MX server, you are
very likely to be sorry when dspam goes down and your e-mail starts
bouncing, instead of safely queuing up on some other server.
YMMV - don't come to me crying if the above script spews millions of
messages into your filesystem - you are strongly encouraged to break up
the dspam.messages file into more reasonable sized chunks before processing.
John
--
John Peacock
Director of Information Research and Technology
Rowman & Littlefield Publishing Group
4501 Forbes Boulevard
Suite H
Lanham, MD 20706
301-459-3366 x.5010
fax 301-429-5748
