gistfile1.pl

    # FastHeuristics enabled, run it...
    if ($fasth) {
        my $urls = $transaction->notes('urls') || [];

        $tran_obj = ML::FastHeuristics::Transaction->new($transaction->mail,
                                                         cynic       => $self->cynic,
                                                         transaction => $transaction,
                                                         threshold   => $threshold,
                                                         uris        => $urls,
                                                        );
        eval { $fasth->check_mail($tran_obj); $fasth_ran = 1 };

        if (my $err = $@) {
            alarm(0);
            $self->handle_error($transaction, "FH:$err", 1); # called with do_not_die = 1

            # Now load SA, so we fall back on that:
            if (!$sa) {
                my @all_files = $self->rule_files;
                my $rules = $self->load_rules(@all_files);
                $sa = $self->create_sa($rules);
            }

            # Now disable FastH so we don't do a comparison below
            $fasth = undef;
            # and reset the alarm
            alarm($timeout);
        }
    }

    # SA enabled, run it...
    if ($sa) {
        my $lines = _get_mail_lines($mail);
        $sa_mail = $sa->parse($lines);
        $status = eval { $sa->check($sa_mail) };

        if (my $err = $@) {
            alarm(0);
            $self->handle_error($transaction, "SA:$err"); # this die()s
        }
    }

handle_error.pl

sub handle_error {
    my ($self, $transaction, $err, $do_not_die) = @_;

    # first look for non-timeout errors (note: "!~")
    if ($err !~ /timeout working on:/) {
        if ($do_not_die) {
            return $self->log(LOGERROR, $err);
        }

        die $err;
    }

    # Now deal with timeout errors - we want an AAS raised, a sample taken
    # and a radar message sent.
     
    # raise AAS alert
    eval {
        $ALERT->Create(text => $err, msgid => ALERT_MSGID_SA_HANG) if $ALERT;
    };
    if ($@) {
        # Creating the alert can fail for several reasons, like having
        # too many alert files in /var/log/ml-alerts/
        $self->log(LOGERROR, "Couldn't create alert for '$err': $@");
    }

    # base64 encode as this error is included in SpamReason - don't
    # want customers to query this.
    (my $base64_err = encode_base64($err)) =~ s/\s//g;

    # ask for sample
    $transaction->notes('do_sample', 'sahang:hang detected');
    # send radar message
    $self->radar($transaction, "error", 0, $base64_err);

    # propogate error
    if ($do_not_die) {
        return $self->log(LOGERROR, $err);
    }

    die $err;
}