>-----Original Message----- >From: lists [mailto:[EMAIL PROTECTED] >Sent: Monday, July 12, 2004 3:22 PM >To: [EMAIL PROTECTED] >Subject: RE: Spamd eating memory till a system crash no ardchinve >solutionsfound. > > >-> -----Original Message----- >-> From: Chr. von Stuckrad [mailto:[EMAIL PROTECTED] On >-> Behalf Of Chr. von Stuckrad >-> Sent: Monday, July 12, 2004 10:18 AM >-> To: [EMAIL PROTECTED] >-> Subject: Re: Spamd eating memory till a system crash no >-> ardchinve solutionsfound. >-> >-> >-> On Mon, Jul 12, 2004 at 02:53:01PM +0000, Tim Philip wrote: >-> > > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM >-> TIME CPU COMMAND >-> > >21539 nobody 15 0 359M 118M 220 D 0.0 15.7 >-> 5:53 0 spamd >-> >-> OUTCH! >300M is really heavy footprint. >-> >-> The only time something like that hit me, was a combination >-> of 'endless' (unbounded?) pattern in a selfmade rule and >-> 'large Mails' (I explicitely allowed 10M mails to be checked), >-> >-> Check for any selfmade rules, that result in[1]: >-> >-> (something)* >-> --------------^ >-> instead of >-> >-> (something){in,max} >-> ------------------^^^^ >-> >-> and change the '*' into something with a reasonalble maximum length. >-> >-> After fixing this, and allowing for only maximal 5M mails, >-> my spamd went down to 21M and is now after many new >-> SARE-Rules added near 30M each child. (It went to >50 <60 >-> with the new BIG bigeval, but then I changed to 'SURBL's). >-> >-> Stucki >-> >-> [1] Those unbounded Patterns can of course be something small >-> like a simple '.*' or as big as a long 'bracketed' rule >-> with an '*' at the end. Also a lot of different >-> 'unfactorized' alternatives '(.1.|.2.|.....)?' and other >-> such 'complications' can bloat the spamd. >-> >-> Every time a rule *possibly* needs to come back to a >-> 'former state of affairs' to recheck something, a big >-> memory allocation is done and saved for a while... >-> >-> And this 'multiplies' (or eponetiates?) with the length >-> of the checked mail, because it is seeh as a whole long >-> string (and not a number of lines!). > > >This is done with default canned rule. Most of the time spamy works >correctly but it somehow decides to eat everything in sight. I >have looked >in the queues at the msgs and found nothing strange about them >or they are >cc'ed to 5-10 people here. I can't keep the server running >for any length >of time because it keeps doing the above top output. Also my >sa is set to >768k message size > >Any ideas
You are saying a default install of SA is running over 350 megs?! Something is seriously wrong with the install. Remove and reinstall it. Possibly install SA 3.0-pre2. --Chris
