Messaging Gateway

I,

Symantec Mail Security, version 7.6.1.7, i received an email from process-cleanup@domain.com:

"filter-hub crashed on signal 11 on ...... exit code: 0x008B"

I found several mistakes in my appliance 8360 series:

 - PID 26802 \'filter-hub\' has died, terminated on signal 11 (0x008B)

 - The engine was unable to be kicked

 - kicker: can not open filter-hub pid file /data/scanner/jobs/filter-hub/filter-hub.pid: No such file or directory 

you know what that is?

thanks, Alessandro

Hello Alessandro,

When was that error logged? On Monday we had a problem which caused filter-hub crashes for some customers. If that is the case, the issue is resolved. If you are seeing the error now, it could be a malformed message that caused the error.

Filter-hub will recover from a crash so unless you are seeing the errors continuously you should be ok.

Thanks!

Tom

Hi Tom,

I too am getting these errors now.  I am also getting:

=====

filter-hub crashed on signal 6 on MX1.domain.com
exit code: 0x0086

Program output:
*** glibc detected 2008.11.24-02.43.45 2008.11.24-03.11.20 2008.11.24-04.56.14 2008.11.24-06.45.55 2008.11.24-08.08.05 2008.11.24-08.58.45 filter-hub.out double free or corruption (!prev): 0x090ca1c8 ***

====

They are happening once every couple hours.  Is it something I should be concerned about?  If it's only malformed messages and it isn't causing permanent corruption then it's only a nuisanceand I won't loose sleep over it.  Maybe it will pass...  My machine is a Virtual appliance and is up to date.

Thanks,

Phil

Hi Phil,

That is the same error that we were seeing that day. It's odd that it is continuing to happen for you though. We found at that time that it was due to a few factors with a ruleset that went out and had it resolved that day. Let me see if we have any other reports of that still happening and if we have a remediation for it.

I'll post again soon.

Thanks!

Tom

Hello Phil,

I checked into this and there don't seem to be any issues due to the ruleset anymore. However, a filter-hub crash can still be caused by either malformed messages or messages where our decomposer has difficulty. If you would like you can log a support ticket and see what we can do about it, but you may want to look to see if you can find out what messages is causing the crash first. This would most likely be asked for along with logs.

Since the filter-hub seems to be recovering in your situation I wouldn't say it's necessarily urgent, but if it seems to happen too often or you feel you are losing messages you may want to call in.

Thanks!

Tom

Thanks for the reply Tom,

Today it seems to have quieted down.  I didn't get any of those errors since late yesterday and I only had one message saying the Filter_Hub restarted after improper shutdown.

I guess it was a flurry of bad messages.  That scanner is the last MX of 3 scanners and it's also the control center.  It's funny that none of the other scanners got hit like this though, especially since it's the last MX.

How would I determine the message/s causing this?  Is the message wrapped up in the crash log that's generated?

Thanks,

Phil

That's good that you aren't seeing this issue as often.

The fact that it is generally happening on the lowest "weight" scanner doesn't really surprise me that much. Spammers will frequently target lowest weight MX records because people tend to use these as a "backdoor" just in case scanning fails, and many times wont have anti-spam scanning on those MX's. And, (big surprise) spammers will often be the ones sending the offending mail as being malformed.

So first of all, it's also good to hear that you have AS scanning on all MX's. Secondly, it may be more trouble than it's worth with what is previously stated. There may be a message ID associated with the crash, but most likely you will be either catching the message in the queue at the time of crash, or looking at coinciding time stamps.

Past that though it sounds like you are doing ok. But if there is more concern I would suggest logging a support ticket if you wanted to look into it further.

Thanks again!

Tom

Thanks Tom,

Everything you said makes sense including picking on the later MX.  When I was running NAVIEG and SMSMTP I did see that those later MX's seemed to get more than their fair share of junk.

I just got one crash a few minutes ago but I'm now convinced it's harmless.  I'll get a support ticket if it seems to be doing any harm.  I just have to remember to purge the dumps.  They are pretty large.

I'm just glad the big spam player is out of business as of a couple weeks ago.  I was doing close to 750k messages a day with about 99% killed then the day after they shut him down it dropped to about 180k.  I thought at first I had a problem...  All our problems should be so good!!

Thanks for the help

Phil