The mailing list for listmasters using Sympa

[IKEDA Soji <address@concealed>]

Hi Stephen,

    On 2022/07/15 0:48, Stephen Jarjoura wrote:

Yesterday evening we received a message that caused all of the sympa processes to stop. When I restarted them, they just immediately stopped again. We couldn't clear the issue until we moved the message (and its lock file) out of the msg queue.

        The
          message doesn't look malicious, but obviously something is
          wrong with it. It was spam from a recruiter trying to get one
          of our alumni to apply for a position. The message had a plain
          text and an html body, and two attachments, one MS Word and
          one smime.p7s.
        
        
        When I
          checked the logs, I didn't see any errors, only an
          acknowledgement that a SIGTERM had been issued and that the
          processes had "exited normally due to signal." As soon as the
          processes had all stopped, Sympa initiated a health check,
          which did not indicate a problem.
        
        
        For now,
          we've blocked the sender at our mail router, but that doesn't
          prevent the sender from changing their source address or from
          another sender sending a similarly poisoned message.
        
        
        Has
          anyone seen this before? How do I go about finding out what
          about the message caused a SIGTERM to be issued? Is there
          another log file or logging level that would describe what
          happened?

Can you send me the message file you moved? I'll investigate it.

Additionally, Could you please check the contents of <number>.stderr files under the $SPOOLDIR/tmp directory? The <number> represents the PID.

For example, there may be some information left over from the crash of sympa_msg in a file 83106.stderr.

Regards,

-- Soji

Jul 13 15:43:37 sympahostname sympa_msg[83106]: notice Sympa::Spindle::ProcessIncoming::_twist() Processing Sympa::Message <address@concealed>; address@concealed; address@concealed; address@concealed

Jul 13 15:43:37 sympahostname archived[83130]: notice main::sigterm() Signal TERM received, still processing current task
Jul 13 15:43:37 sympahostname archived[83130]: notice main:: Archived exited normally due to signal
Jul 13 15:43:37 sympahostname bounced[83135]: notice main::sigterm() Signal TERM received, still processing current task
Jul 13 15:43:37 sympahostname bounced[83135]: notice main:: Bounced exited normally due to signal
Jul 13 15:43:37 sympahostname task_manager[83107]: notice main::sigterm() Signal TERM received, still processing current task
Jul 13 15:43:37 sympahostname task_manager[83107]: notice main:: Task_Manager exited normally due to signal
Jul 13 15:43:37 sympahostname bulk[83132]: notice main::sigterm() Signal TERM received, still processing current task
Jul 13 15:43:37 sympahostname bulk[83132]: notice main:: Bulk exited normally due to signal
Jul 13 15:48:17 sympahostname sympa/health_check[96594]: info main:: Configuration file read, default log level 1
Jul 13 15:48:17 sympahostname sympa/health_check[96594]: debug Sympa::DatabaseDriver::MySQL::get_tables() Retrieving all tables in database sympa

-- 

Stephen A. Jarjoura

(e) address@concealed
Collaborative Systems Group

Information Technology Services

Boston College

-- 
株式会社 コンバージョン
ITソリューション部 システムソリューション1グループ 池田荘児
e-mail address@concealed
https://www.conversion.co.jp/