MS/perl segfaults

[Jethro R Binks]

On Mon, 10 Nov 2008, David Lee wrote:

> We've just had such an incident over the weekend.  And there were enough 
> such messages (about 100) to cause all the child MS processes (20) to 
> segfault on most occasions that they processed a batch (30).  The net 
> result is that our inbound queue grew, and very little trickled through, 
> because the MS processes segfaulted, re-tried, segfaulted, retried, ...

...

Having been bitten by similar problems from time to time, I lately wrote a 
rule for SEC which watches the syslogs from MailScanner, and should 
trigger if it sees a message id coming around again and again, which some 
people may find useful:

type=singlewiththreshold
ptype=regexp
pattern=(\S+)\s+MailScanner\[\d+\]: Message (\S+) from
desc=Mailscanner $1 MSGID $2
window=240
thresh=10
action=write /logs/net/secwatch %t | MailScanner repeated Message id $2 on $1

The window and threshold numbers probably need tweaking; I'm waiting for 
the next occurrence of the problem to fine-tune the rule.

Jethro.


-- 
.  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .
Jethro R Binks
Computing Officer, IT Services, University Of Strathclyde, Glasgow, UK