The mailing list for listmasters using Sympa

[Stephen Jarjoura <address@concealed>]

Yesterday evening we received a message that caused all of the sympa processes to stop. When I restarted them, they just immediately stopped again. We couldn't clear the issue until we moved the message (and its lock file) out of the msg queue.

The message doesn't look malicious, but obviously something is wrong with it. It was spam from a recruiter trying to get one of our alumni to apply for a position. The message had a plain text and an html body, and two attachments, one MS Word and one smime.p7s.

When I checked the logs, I didn't see any errors, only an acknowledgement that a SIGTERM had been issued and that the processes had "exited normally due to signal." As soon as the processes had all stopped, Sympa initiated a health check, which did not indicate a problem.

For now, we've blocked the sender at our mail router, but that doesn't prevent the sender from changing their source address or from another sender sending a similarly poisoned message.

Has anyone seen this before? How do I go about finding out what about the message caused a SIGTERM to be issued? Is there another log file or logging level that would describe what happened?

Jul 13 15:43:37 sympahostname sympa_msg[83106]: notice Sympa::Spindle::ProcessIncoming::_twist() Processing Sympa::Message <address@concealed>; envelope_sender=address@concealed; message_id=address@concealed; sender=address@concealed

Jul 13 15:43:37 sympahostname archived[83130]: notice main::sigterm() Signal TERM received, still processing current task
Jul 13 15:43:37 sympahostname archived[83130]: notice main:: Archived exited normally due to signal
Jul 13 15:43:37 sympahostname bounced[83135]: notice main::sigterm() Signal TERM received, still processing current task
Jul 13 15:43:37 sympahostname bounced[83135]: notice main:: Bounced exited normally due to signal
Jul 13 15:43:37 sympahostname task_manager[83107]: notice main::sigterm() Signal TERM received, still processing current task
Jul 13 15:43:37 sympahostname task_manager[83107]: notice main:: Task_Manager exited normally due to signal
Jul 13 15:43:37 sympahostname bulk[83132]: notice main::sigterm() Signal TERM received, still processing current task
Jul 13 15:43:37 sympahostname bulk[83132]: notice main:: Bulk exited normally due to signal
Jul 13 15:48:17 sympahostname sympa/health_check[96594]: info main:: Configuration file read, default log level 1
Jul 13 15:48:17 sympahostname sympa/health_check[96594]: debug Sympa::DatabaseDriver::MySQL::get_tables() Retrieving all tables in database sympa

-- 

Stephen A. Jarjoura

(e) address@concealed

Collaborative Systems Group

Information Technology Services

Boston College