Mailscanner suddenly started taking up 100% of available memory

[Andrew Hoying]

Some more information.

Here is the process after only 9 minutes:

USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root      7644 21.0 68.1 107408 85776 ?      S    11:07   1:51 /usr/bin/perl
/usr/local/MailScanner/bin/mailscanner
Fri Apr 19 11:16:14 MDT 2002

And here is the changed files in the last 3 days:

[/usr]# find ./ -mtime -3
./local/uvscan
./local/uvscan/scan.dat
./local/uvscan/names.dat
./local/uvscan/clean.dat
./local/uvscan/readme.txt
./local/uvscan/file_id.diz
./local/uvscan/mcscript.ini
./local/uvscan/packing.lst
./local/uvscan/pkgdesc.ini
./local/uvscan/validate.exe
./local/uvscan/delta.ini
./local/uvscan/dat-4197.tar
./local/uvscan/reseller.txt
./local/MailScanner/etc
./local/MailScanner/var/virus.pid

It's to the point where I've been restarting mailscanner every 15 minutes to
keep the system running smoothly.

Any help at all is greatly appreciated.

Thank you,
Andrew

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Andrew Hoying
> Sent: Friday, April 19, 2002 9:30 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Mailscanner suddenly started taking up 100% of available memory
>
>
> Yesterday morning, for the first time, mailscanner began consuming several
> hundred megabytes of memory every hour until the system ran out of memory
> and killed mailscanner. The process would then repeat every 4 hours or so.
> Regardless of the fact that I should have resource limits in place to
> prevent mailscanner from using all the memory, I've never seen
> this behavior
> before. I've been running mailscanner on this server since October of last
> year without any similar problems. I am currently running version  3.13-2.
> The only thing that changed, and I'm pretty sure that this is the culprit,
> is that mcafee auto-updated to dat version 4197 on Wednesday. I'm not sure
> where to begin troubleshooting this particular problem, and certainly am
> open to suggestions.
>
> Thank you,
> Andrew
>