dying children?

Wed Jul 30 03:48:01 IST 2008

>>> On 7/29/2008 at 5:07 PM, in message <488F867C.1000102 at fsl.com>, Steve Freegard
<steve.freegard at fsl.com> wrote:
> That would seem to indicate a problem with a Perl module that uses XS 
> (e.g. C functions into Perl) and not with MailScanner itself.
> 
> You would have to install 'strace' and run the message through again 
> like so:
> 
> strace MailScanner --debug --debug-sa
> 
> And then look at around the last 25-50 lines or so for clues.
> 
> I've seen this happen before; mainly with Mail::ClamAV (which is why I 
> prefer clamd now); but I've seen it happen with other modules too.

As I imagined, there is a BUNCH of output from strace. I will try to find the relevant sections at the bottom of the output:

(from MailScanner output)
22:43:39 [16217] dbg: check: tests=MISSING_DATE,MISSING_HEADERS,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS
22:43:39 [16217] dbg: check: subtests=__HAS_MSGID,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__SARE_WHITELIST_FLAG,__TVD_BODY,__UNUSABLE_MSGID
22:43:39 [16217] dbg: bayes: untie-ing
22:43:39 Building a message batch to scan...
22:43:39 Have a batch of 1 message.
max message size is '100k'

(from strace)
16217 open("/usr/lib/perl5/5.8.8/Text/ParseWords.pm", O_RDONLY|O_LARGEFILE) = 11
<snip>
16217 open("/usr/lib/perl5/5.8.8/i586-linux-thread-multi/auto/PerlIO/scalar/scalar.so", O_RDONLY) = 11
<snip>
read(12, "<html><!--**********************"..., 4096) = 4096
read(12, "T size=2><FONT size=2><FONT size"..., 4096) = 4096
write(11, "<html><!--**********************"..., 4096) = 4096
read(12, " size=2><FONT size=2><FONT size="..., 4096) = 4096
write(11, "T size=2><FONT size=2><FONT size"..., 4096) = 4096
read(12, "size=2><FONT size=2><FONT size=2"..., 4096) = 4096
write(11, " size=2><FONT size=2><FONT size="..., 4096) = 4096
read(12, "ize=2><FONT size=2><FONT size=2>"..., 4096) = 4096
write(11, "size=2><FONT size=2><FONT size=2"..., 4096) = 4096
read(12, "=2><FONT size=2><FONT size=2><FO"..., 4096) = 4096
read(12, "2><FONT size=2><FONT size=2><FON"..., 4096) = 4096
read(12, "><FONT size=2><FONT size=2><FONT"..., 4096) = 4096
read(12, "/FONT></FONT></FONT></FONT></FON"..., 4096) = 4096
read(12, "FONT></FONT></FONT></FONT></FONT"..., 4096) = 4096
brk(0xb93f000)                          = 0xb93f000
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
Process 16009 detached

The original mailfile had *many* of the "<FONT size=2>" in a row. Not sure if that is causing issues.

Any other testing? Or if anyone would like a copy of this mailfile, I'm happy to send it along.

Thanks again.