lha crash, but which mail caused it?

[Ralf Hildebrandt]

Today I found:
Feb 25 13:39:41 mail kernel: [949050.319465] lha[2480]: segfault at bfec787d ip 0804d62a sp bfec316c error 4 in lha[8048000+d000]

Since amavis is the only program to use lha I'd like to know which
mail caused thus. But how do I find the mail that caused this?

# fgrep amavis /var/log/mail.log |egrep " 13:3[89]:" | grep -i Content-Type
Feb 25 13:38:06 mail amavis[511]: (00511-07) p001 1 Content-Type: text/plain, size: 1550 B, name: 
Feb 25 13:38:06 mail amavis[31924]: (31924-15) p001 1 Content-Type: text/html, size: 15668 B, name: 
Feb 25 13:38:09 mail amavis[32013]: (32013-06) p001 1 Content-Type: text/html, size: 28 B, name: 
Feb 25 13:38:09 mail amavis[31924]: (31924-16) p003 1 Content-Type: multipart/alternative
Feb 25 13:38:09 mail amavis[31924]: (31924-16) p001 1/1 Content-Type: text/plain, size: 1135 B, name: 
Feb 25 13:38:09 mail amavis[31924]: (31924-16) p002 1/2 Content-Type: text/html, size: 30681 B, name: 
Feb 25 13:38:18 mail amavis[1485]: (01485-06) p001 1 Content-Type: text/html, size: 8712 B, name: 
Feb 25 13:38:23 mail amavis[31924]: (31924-17) p003 1 Content-Type: multipart/alternative
Feb 25 13:38:23 mail amavis[31924]: (31924-17) p001 1/1 Content-Type: text/plain, size: 1138 B, name: 
Feb 25 13:38:23 mail amavis[31924]: (31924-17) p004 1/2 Content-Type: multipart/related
Feb 25 13:38:23 mail amavis[31924]: (31924-17) p002 1/2/1 Content-Type: text/html, size: 7470 B, name: 
Feb 25 13:38:27 mail amavis[30833]: (30833-19) p003 1 Content-Type: multipart/mixed
Feb 25 13:38:27 mail amavis[30833]: (30833-19) p004 1/1 Content-Type: multipart/alternative
Feb 25 13:38:27 mail amavis[30833]: (30833-19) p001 1/1/1 Content-Type: text/plain, size: 9810 B, name: 
Feb 25 13:38:27 mail amavis[30833]: (30833-19) p002 1/1/2 Content-Type: text/html, size: 105514 B, name: 
Feb 25 13:38:31 mail amavis[1485]: (01485-07) p003 1 Content-Type: multipart/alternative
Feb 25 13:38:31 mail amavis[1485]: (01485-07) p001 1/1 Content-Type: text/plain, size: 1139 B, name: 
Feb 25 13:38:31 mail amavis[1485]: (01485-07) p002 1/2 Content-Type: text/html, size: 30685 B, name: 
Feb 25 13:38:33 mail amavis[30817]: (30817-14) p001 1 Content-Type: text/plain, size: 3202 B, name: 
Feb 25 13:38:47 mail amavis[26705]: (26705-15) p001 1 Content-Type: text/plain, size: 3583 B, name: 
Feb 25 13:38:50 mail amavis[30833]: (30833-20) p003 1 Content-Type: multipart/alternative
Feb 25 13:38:50 mail amavis[30833]: (30833-20) p001 1/1 Content-Type: text/plain, size: 756 B, name: 
Feb 25 13:38:50 mail amavis[30833]: (30833-20) p002 1/2 Content-Type: text/html, size: 22982 B, name: 
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p010 1 Content-Type: multipart/related
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p011 1/1 Content-Type: multipart/alternative
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p001 1/1/1 Content-Type: text/plain, size: 4366 B, name: 
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p002 1/1/2 Content-Type: text/html, size: 83048 B, name: 
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p003 1/2 Content-Type: image/jpeg, size: 7732 B, name: clip_image001[2].jpg
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p004 1/3 Content-Type: image/jpeg, size: 6113 B, name: clip_image002[2].jpg
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p005 1/4 Content-Type: image/png, size: 335531 B, name: clip_image004[2].png
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p006 1/5 Content-Type: image/png, size: 567252 B, name: clip_image006[2].png
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p007 1/6 Content-Type: image/png, size: 494832 B, name: clip_image008[2].png
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p008 1/7 Content-Type: image/png, size: 678546 B, name: clip_image010[2].png
Feb 25 13:38:51 mail amavis[32257]: (32257-10) p009 1/8 Content-Type: image/png, size: 533920 B, name: clip_image012[2].png
Feb 25 13:39:03 mail amavis[2072]: (02072-01) p004 1 Content-Type: multipart/mixed
Feb 25 13:39:03 mail amavis[2072]: (02072-01) p005 1/1 Content-Type: multipart/alternative
Feb 25 13:39:03 mail amavis[2072]: (02072-01) p001 1/1/1 Content-Type: text/plain, size: 260 B, name: 
Feb 25 13:39:03 mail amavis[2072]: (02072-01) p002 1/1/2 Content-Type: text/html, size: 393 B, name: 
Feb 25 13:39:03 mail amavis[2072]: (02072-01) p003 1/2 Content-Type: image/jpeg, size: 280694 B, name: Approba.jpg
Feb 25 13:39:04 mail amavis[603]: (00603-03) p001 1 Content-Type: text/html, size: 12882 B, name: 
Feb 25 13:39:09 mail amavis[2072]: (02072-02) p001 1 Content-Type: text/html, size: 12858 B, name: 
Feb 25 13:39:21 mail amavis[603]: (00603-04) p001 1 Content-Type: text/html, size: 3121 B, name: 
Feb 25 13:39:26 mail amavis[30937]: (30937-15) p001 1 Content-Type: text/plain, size: 1367 B, name: 
Feb 25 13:39:27 mail amavis[2072]: (02072-03) p001 1 Content-Type: text/html, size: 9857 B, name:
Feb 25 13:39:27 mail amavis[30937]: (30937-16) p003 1 Content-Type: multipart/alternative
Feb 25 13:39:27 mail amavis[30937]: (30937-16) p001 1/1 Content-Type: text/plain, size: 189 B, name: 
Feb 25 13:39:27 mail amavis[30937]: (30937-16) p002 1/2 Content-Type: text/html, size: 3884 B, name: 
Feb 25 13:39:29 mail amavis[30817]: (30817-15) p003 1 Content-Type: multipart/alternative
Feb 25 13:39:29 mail amavis[30817]: (30817-15) p001 1/1 Content-Type: text/plain, size: 14 B, name: 
Feb 25 13:39:29 mail amavis[30817]: (30817-15) p002 1/2 Content-Type: text/html, size: 9963 B, name: 
Feb 25 13:39:30 mail amavis[1485]: (01485-08) p004 1 Content-Type: multipart/mixed
Feb 25 13:39:30 mail amavis[1485]: (01485-08) p001 1/1 Content-Type: text/plain, size: 402 B, name: 
Feb 25 13:39:30 mail amavis[1485]: (01485-08) p002 1/2 Content-Type: message/rfc822, size: 58543 B, name: 
Feb 25 13:39:30 mail amavis[1485]: (01485-08) p003 1/3 Content-Type: message/rfc822, size: 701 B, name: 
Feb 25 13:39:37 mail amavis[30937]: (30937-17) p003 1 Content-Type: multipart/mixed
Feb 25 13:39:37 mail amavis[30937]: (30937-17) p001 1/1 Content-Type: text/plain, size: 1 B, name: 
Feb 25 13:39:37 mail amavis[30937]: (30937-17) p002 1/2 Content-Type: application/zip, size: 3897513 B, name: humanresearch.zip
Feb 25 13:39:38 mail amavis[31924]: (31924-18) p001 1 Content-Type: text/plain, size: 990 B, name: 
Feb 25 13:39:49 mail amavis[1540]: (01540-01) p003 1 Content-Type: multipart/alternative
Feb 25 13:39:49 mail amavis[1540]: (01540-01) p001 1/1 Content-Type: text/plain, size: 9250 B, name: 
Feb 25 13:39:49 mail amavis[1540]: (01540-01) p002 1/2 Content-Type: text/html, size: 16255 B, name: 
Feb 25 13:39:53 mail amavis[497]: (00497-10) p001 1 Content-Type: text/html, size: 3103 B, name: 
Feb 25 13:39:56 mail amavis[1540]: (01540-02) p001 1 Content-Type: text/plain, size: 958 B, name: 

mail:/var/amavis# fgrep amavis /var/log/mail.log |egrep -i preserving
mail:/var/amavis# 

-- 
Ralf Hildebrandt                   Charite Universitätsmedizin Berlin
ralf.hildebrandt at charite.de        Campus Benjamin Franklin
http://www.charite.de              Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155