[Rspamd-Users] duplicate error in logfile

[G.W. Haywood]

Hi there,

On Sat, 23 Mar 2024, christian via Users wrote:

> I have recently had around 10 "duplicate" entry warnings in my log.
>  But I can't find the duplicates in the associated map file. The term only 
> appears once. Then where is this duplicate? I deleted the redis database.
> The problem that occurs now is that a service rspamd restart takes almost a 
> minute.
> ...
> 2024-03-23 12:27:22 [warn] #172084(main) <uqpyz9>; map; 
> rspamd_map_helper_insert_re: duplicate re entry found for map 
> /etc/rspamd/maps.d/regex_body-HAM.map: geburtsurkunde (old value: '1', new: 
> '1')

Regular expressions are tricky.  Taking the fact that you seem to be
experiencing a drop in performance together with the warnings in your
log, I suspect that you have crafted a regex which is (a) not doing
what you think it's doing and (b) extremely inefficient, so causing
excessive CPU usage.  It's easy to get regexes ranges so badly wrong
that you DOS yourself, especially if they use the '*' character.

It might be easier if you can post the map file, but if you don't want
to put it on the public list then do please feel free to send it to me
privately.  The message will probably be rejected (private mail to my
list address) but I'll see it anyway.

-- 

73,
Ged.