Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (nike.apache.org: local policy)
Message-ID: <4A778C2A.7010901@trimble.co.nz>
Date: Tue, 04 Aug 2009 13:17:30 +1200
From: Jason Haar <Jason.Haar@trimble.co.nz>
Organization: Trimble Navigation Ltd.
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
 rv:1.9.1b3pre) Gecko/20090513 Fedora/3.0-2.3.beta2.fc11 Thunderbird/3.0b2
MIME-Version: 1.0
To: users@spamassassin.apache.org
Subject: large unicode email nails CPU
Content-Type: multipart/alternative;
 boundary="------------000905090608000307070707"

This is a multi-part message in MIME format.
--------------000905090608000307070707
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi there

We're got a few people subscribed to Serbian mailing-lists, and one in 
particular is having difficulty getting email to us - spamc/spamd times 
out and is never able to process the message. While it is running, spamd 
takes 100% of the CPU for 1.5+minutes.

Here's an example: http://pastebin.com/m75f39d72

strace shows spamd running around looking for unicore/lib/gc_sc files - 
which is related to unicode "stuff". I don't know if that's the problem 
- but that's all I could find. "spamassassin -D " doesn't show anything 
strange other than massively long times to process DNSBLs. They are not 
believable: the "slow" DNSBLs change from invocation to invocation (of 
the same message), and "dig" shows no such issues - the DNSBLs SA says 
are taking 99sec to complete return instantly via dig (and yes, local 
caching DNS). Also, it is specifically a problem with these emails - in 
general we are not seeing any problems with any other email.

We've also got SA in several countries, all on CentOS5 servers 
(perl-5.8.8,spamassassin-3.2.5-1) and they all show the same symptoms - 
so I don't think it's network related but rather CPU: basically these 
emails nail SA and it's slow to finish for them?

Any ideas? Thanks!

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


--------------000905090608000307070707
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#ffffff">
<font face="Liberation Sans">Hi there<br>
<br>
We're got a few people subscribed to Serbian mailing-lists, and one in
particular is having difficulty getting email to us - spamc/spamd times
out and is never able to process the message. While it is running,
spamd takes 100% of the CPU for 1.5+minutes. <br>
<br>
Here's an example: <a class="moz-txt-link-freetext" href="http://pastebin.com/m75f39d72">http://pastebin.com/m75f39d72</a><br>
<br>
strace shows spamd running around looking for unicore/lib/gc_sc files -
which is related to unicode "stuff". I don't know if that's the problem
- but that's all I could find. "spamassassin -D " doesn't show anything
strange other than massively long times to process DNSBLs. They are not
believable: the "slow" DNSBLs change from invocation to invocation (of
the same message), and "dig" shows no such issues - the DNSBLs SA says
are taking 99sec to complete return instantly via dig (and yes, local
caching DNS). Also, it is specifically a problem with these emails - in
general we are not seeing any problems with any other email.<br>
<br>
We've also got SA in several countries, all on CentOS5 servers
(perl-5.8.8,spamassassin-3.2.5-1) and they all show the same symptoms -
so I don't think it's network related but rather CPU: basically these
emails nail SA and it's slow to finish for them?<br>
<br>
Any ideas? Thanks!<br>
<br>
</font>
<pre class="moz-signature" cols="72">-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
</pre>
</body>
</html>

--------------000905090608000307070707--