Memory leak and SMTP failure
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6677
Printed Date: 05 February 2025 at 6:07pm
Topic: Memory leak and SMTP failure
Posted By: gillonba
Subject: Memory leak and SMTP failure
Date Posted: 28 May 2009 at 1:18pm
We recently added a large client to our anti-spam system, increasing the load on our servers several times over. Since the client is very important, we started monitoring the servers with Whats Up Gold shortly after. We have two anti-spam virtual servers running Windows 2003 under Hyper-V. Both servers are running v.4.0.1.786 with the latest release version of the anti-virus plugin, 6.1.5.0 I think.
The only issue we had that was visible to the client was that they receive PDF files from many of their own partners, and the spam filter was rejecting these PDFs, until we whitelisted the senders.
On our end, both servers have exhibited steadily increasing memory usage since we started monitoring last week. Then yesterday the SMTP service on server 1 locked up at about 2:40pm. From 14:39 to 15:06 the logs are empty, when the log was spammed with
05/27/09 15:06:26:454 -- (2272) Listen Exception occurred: Thread creation error: Not enough storage is available to process this command
occasionally there is a line like:
05/27/09 23:45:30:510 -- Exception occurred during DumpLog: Cannot open file "C:\Program Files\SpamFilter\logfiles\20090527.log". The process cannot access the file because it is being used by another process
This continued until the server was rebooted.
So to summarize: we are using the latest release version of the Spam Filter witht he AV plugin, there appears to be a memory leak, and there are many PDF files going through the system. I mention the PDFs because a search for "memory leak" revealed a thread with what looks like a similar problem that apparently was resolved.
http://www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=6609&KW=memory+leak&PID=12614#12614
Any suggestions or comments would be welcome
|
Replies:
Posted By: LogSat
Date Posted: 28 May 2009 at 3:19pm
A couple of years ago there was a huge surge of such spam (emails with PDF attachments advertising stock symbols), but this type of spam is now drastically reduced, and this feature (the scanning of images within PDF files, which may be the cuplprit that is causing legitimate PDFs from being blocked) can be safely disabled. This is done by editing the SpamFilter.ini file and finding and setting the following value to zero:
SpamPDFMaxPagesToScan=0
This change can be made while SpamFilter is running, there is no need to stop/restart SpamFilter.
The memory corruption you mentioned in the other forum thread actually dealt with memory corruption, not memory leaks, so that is unlikely to be an issue.
We are however aware of other memory leaks present in the PDF library we use to scan images as per above, and for this reason, along with the fact that such spam is no longer present, we just released yesterday a new build of SpamFIlter that, besides featuring a new memory manager, also has the PDF scanning functionality disabled completely in the product. The pre-release build is v4.1.2.811, and is available for download in the user area on our website.
I would suggest to first try changing the "SpamPDFMaxPagesToScan=0" parameter as that can be done with zero impact. If that does not help, you may want to try upgrading to the latest pre-release build.
Another option is that you could zip and email us SpamFilter's activity logfile for a day (after you have restarted SpamFilter as to start with a fresh instance) so we can scan them for other issues. If the zip file is over 5MB in size I'll provide you via a PM with the FTP credentials for our ftp site.
-------------
Roberto Franceschetti
http://www.logsat.com" rel="nofollow - LogSat Software
http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP
|
Posted By: gillonba
Date Posted: 28 May 2009 at 3:24pm
Thanks! I will try setting
SpamPDFMaxPagesToScan=0
and see if that helps
|
Posted By: yapadu
Date Posted: 29 May 2009 at 8:58am
Wow! So PDF scanning will no longer be available at all? Not just disabled by default, but gone?
So if spammers start up again with the PDF SPAM we would need to update the program - should you decide to allow that again?
|
Posted By: LogSat
Date Posted: 29 May 2009 at 5:28pm
We've been debating over this for the past year internally on how to proceed. On one end we are "stuck" with a PDF library from a 3rd party that we know has a few problems, and can in turn cause problems in SpamFilter, on the other end we have the necessity of being able to allow admins to stop this kind of spam if it presents itself (which it hasn't done in almost a couple of years).
While we've provided users with the solution (disabling the PDF scanning via the ini file setting), this is often a "reaction". SpamFilter crashes a few times (which is of course a bad thing), and the admins may or may not contact us for support. When they do, we (or the support forums) provide the solution. We'd however prefer that SpamFilter would not cause any problems to begin with, and thus would like to remove the PDF functionality until we can obtain a better supported product by our 3rd party provider. I hope you see our dilemma...
We're always open to suggestions, critics, etc., so we'll be happy to hear from your (and other's) opinion on this matter if it can help us better help you all.
-------------
Roberto Franceschetti
http://www.logsat.com" rel="nofollow - LogSat Software
http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP
|
|