Topic: Free disk space diminishing FAST!

[sgt-spam]

Yesterday morning I got a frantic call from the office (I'm out on leave as my wife and I just had our first child).

Apparently things were 'wacky' with the web / email server (SME 6).

After SSHing the box, I determined there was no free space on /dev/md1.  I deleted lots of stuff I was storing there, and usage dropped to below 50% (still more than what it should be).

This morning, I got a call that email was slow.  Disk usage is as reported below.

Only changes are a SpamAssassin update (happens automagically).  RootKit Hunter says everything's cool.  Nothing out of the orginary RE: user mail storage.

What should I check?  I'm at a loss, and server performance is going down the tubes.


Thanks!!!

Code: [Select]

[root@atf-guardian log]# df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/md1             114982144  81541132  27600184  75% /
/dev/md0                101018     14097     81705  15% /boot
none                    515096         0    515096   0% /dev/shm

[cc_skavenger]

check the qmail logs, I bet there is a lot of mail waiting to out.  I would also check the workstations for a virus, like Sober.

just where I would start.

[sgt-spam]

check the qmail logs, I bet there is a lot of mail waiting to out.  I would also check the workstations for a virus, like Sober.

just where I would start.

Outbound message queue looks quite large from the 'report' in server manager.  Come to think of it, I changed the failure handling about a week ago.  This must be part of the reason.

Is it possible to delete the current outbound queue?  I'm up to 80% disk utilization now, and fear I won't make it through the weekend.

[raem]

sgt-spam

>Come to think of it, I changed the failure handling about a week ago.  

What did you change ?

> Is it possible to delete the current outbound queue?  

Install the qmhandle contrib (search) adds a panel to server manager or use command line to drive it.
man qmhandle (from memory)

I'm up to 80% disk utilization now, and fear I won't make it through the weekend.

Stop your mail system
/etc/init.d/smtpfront-qmail stop

allow system to process messages or delete them
find source of messages eg likely a virus infection on a workstation, remove infection etc, check ALL other w/s's
then
/etc/init.d/smtpfront-qmail restart

Upgrade & improve your virus protection, implement multiple layers for good protection see my post
http://forums.contribs.org/index.php?topic=27251.0
and check the various howtos in my contribs area
http://mirror.contribs.org/smeserver/contribs/rmitchell/smeserver/howto/
and Jespers Knudsens site

[sgt-spam]

Thanks for the suggestions...

I've got a couple boxes running 6, and they've been rock solid until this.

Looks like virus activity on a client for sure.  I went through my Symantec logs remotely, and the users I suspect thankfully turned off their boxes Friday night.

Basically a couple user's mail accounts were collecting 2MB delivery failure reports - THOUSANDS of them.  Obviously this took up a little space and slowed mail delivery locally to a stop.

I cleaned up the mailboxes and created a procmail rule to delete the delivery reports.  We're holding steady at about 60% disk usage.  I'm not convinced it should be that high, but at least it's not 100%.

I'm using a variety of contribs from many people here: antivirus, spam, etc.  Didn't have much luck with the patern matching when I put this box in, but I'll have to spend some time this week updating the server.  After I clean up the clients that is.  


Again, thanks.