[Mimedefang] Problem fixed?

[Paul Murphy]

Lisa,

> I deleted my Bayes database (based on a suggestion from 
> someone  that it might be a corrupt bayes database). 

Its worth a try, and I'd be interested to see whether that makes a
difference.  However, some questions, and apologies if you've already been
over some of these:

1.  How big was the Bayes database?  Each SpamAssassin thread ties to the
database, and while the memory use won't be as much as the raw database size
unless your DBM implementation is seriously flawed, it does need space for
the tied hash.  Big database + multiple threads = excessive memory use.

2.  Did you run regular expires on the database using "sa-learn
--force-expire [--showdots -D]"?  The database loses relevance over time, so
it is important to expire it regularly (daily/weekly) to ensure that it is
kept under control.

3.  Are you using Bayes journalling?  This writes updates to a journal file
rather than locking the database, and you then have to merge the journal with
the DB at a suitable quiet time using "sa-learn --sync", although this is
done on a forced expiry run anyway.

4.  Did you keep a copy of the database?  If so, can you successfully dump
the contents using "sa-learn --backup > Bayes.bak"?  If this works, the
database is at least a clean DBM file, although the contents could in theory
have been poisoned by malicious messages.  Poisoning shouldn't impact on
performance at random intervals though.  You may want to clear out the
database using "sa-learn --clear" and then re-import from your backup file
using "sa-learn --restore" to verify that the DBM file is good.  All of this
can be done off-line using the "--dbpath" option to sa-learn to point to
copies of the files.

5.  Do you have "lock_method flock" in your sa-mimedefang.conf file?  If not,
and you do not share the Bayes database over NFS, then you should have it.
The NFS-safe locking mechanism used by SA has always been very dubious, and
I've seen it get into a terrible mess before.  However, this basically only
means that it cannot lock the file, so Bayes updates fail.  Learning to the
journal helps with this.

6.  How has the memory footprint of slaves changed now that the Bayes
database has been cleared?  Are the processes now significantly lower in
memory use?

Best Wishes,

Paul.

-- 
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.375 / Virus Database: 267.14.22/238 - Release Date: 23/01/2006