[Mimedefang] graphdefang cores with large amounts of data

[Lee Dilkie]

>
> > > This sounds like what I was first experiencing when I installed
> > > graphdefang. The solution was to download and unpack a clean
> > > copy of db
> > > from the sleepycat site. I forget if I needed a configure
> in the main
> > > directory, but make / make install in the perl/DB_File
> directory fixed
> > > the problem.
> > >
> > > This was on FreeBSD-4.8 stable.
> > >
> >
> Graham

Well, I downloaded db-4.1.25.NC.tar.gz from the sleepycat site, extracted it
into a local directory, cd'ed to perl/DB_File, did a 'perl Makefile.PL',
'make', 'make test' and 'make install' as the docs suggest.

The resultant DB_File.pm (i'm assuming that the output of all this) is the
same as the version produced by the ports so I wasn't surprised that the
problem still persists.

I still can't get any more than a day and a half, often less, showing up in
the graphs.

One funny thing I notice is that the "max time from summery.db" line does't
always get printed but it always claims "new log lines processed" even as it
appears to drop all the old data.

I have two maillog files that make this 100% reproducible. I've posted (to a
website) the input files, my summary.db and my graphdefang-config if someone
would like to figure out what's getting boned in the db?

http://www.dilkie.com/SummaryDB.db
http://www.dilkie.com/graphdefang-config
http://www.dilkie.com/maillog.0
http://www.dilkie.com/maillog

and

after running 'graphdefang --file maillog.0' i get:

http://www.dilkie.com/defang/bad0/index.php?view=hourly which looks good

but after running 'graphdefang --file maillog' I get:

http://www.dilkie.com/defang/bad1/index.php?view=hourly

which omits the previous data points.

Any takers? This is driving me crazy :)

-lee