Log File Reports Warning Messages "Spamhunter module: pcre_exec failed: errcode"

Article:TECH84086  |  Created: 2006-01-05  |  Updated: 2009-01-11  |  Article URL http://www.symantec.com/docs/TECH84086
Article Type
Technical Solution

Product(s)

Issue



You see similar messages in the log file; the message text is "Spamhunter module:pcre_exec failed: errcode " You need to know what it means?

Symptoms
For Symantec Brightmail Message Filter (SBMF) similar Warning messages are logged in bm_server_log file:


10 Nov 2009 00:36:24 (WARNING:19716.2799692720): [36034] Spamhunter module: pcre_exec failed: errcode -8 regex "<(?:style|title)>\s*(?:[^\/>]+\/){15}".
10 Nov 2009 01:31:16 (WARNING:19716.2791287728): [36034] Spamhunter module: pcre_exec failed: errcode -8 regex "https?:\/\/[^"]*[a-z]{3}([^a-z0-9\s,])(?:[a-z]{3,15}\1){8}".
10 Nov 2009 02:15:08 (WARNING:19716.2795490224): [36034] Spamhunter module: pcre_exec failed: errcode -8 regex "[\<]mailto:[^\[]+\.cn]".

For Symantec Message Security (SMS) the above messages are logged in filter-hub log file. Conditions: In SBMF version 6.0.4 and earlier this message is logged as a WARNING. In SBMF 6.0.5 and above this messages is logged as INFO. For information on how to change logging level see KB How to Enable Debug Troubleshooting Information for Symantec Brightmail Message Filter In SMS version 5.0.1 and earlier this message is logged as a WARNING.

Cause



This warning message occurs when the Spamhunter module attempts to check the listed rule against the message and is unable to do so due to a threshold limit reached for that specific rule.

Solution



The warning itself is stating that a specific rule stopped processing as result of a stack/buffer overflow prevention check. A governor ensures that CPU doesn’t spin out of control. If it's always the same message showing up many times per minute, then it could be a non-performing rule. In this case please contact Symantec support to troubleshoot this Warning message farther. If these messages are intermittent then this Warning message can be safely ignored. Note: All other Spamhunter rules continue to process the message normally.
Technical Information
In the following example: 10 Nov 2009 02:15:08 (WARNING:19716.2795490224): [36034] Spamhunter module: pcre_exec failed: errcode -8 regex "[\[<]mailto:[^\[]+\.cn]". -8 is a pcre match limit recursion failure - it means that the regex has encountered content that goes into deep recursion, and the governor has kicked in to stopped an execution that otherwise might not stop on its own. For full list of concatenations of the PCRE see http://www.pcre.org/pcre.txt

Supplemental Materials

SourceETrack
Value1616056 1620021 26249 22581

Legacy ID



2006010511235863


Article URL http://www.symantec.com/docs/TECH84086


Terms of use for this information are found in Legal Notices