Topic: Incoming Emails not coming in...

[Jasonuocs]

Just an update,
CharlieBrady was spot on it is something to do with Clam AV or Spam Assassin. I have removed both and the customer is collecting emails again wehey, So I have decided against using these products on SME Server as this is the forth problem I have experienced and it is giving my company and SME Mail server a bad name! Now I am sure it must be the way i set it up or something, but I do have two or three sites where it all works a treat so something strange there! I will just have to pay my service provider to remove the spam & viruses...

Thanks for your help guys and the problem is sorted as far as I have time for...

[CharlieBrady]

Just an update,
CharlieBrady was spot on it is something to do with Clam AV or Spam Assassin. I have removed both and the customer is collecting emails again wehey, So I have decided against using these products on SME Server as this is the forth problem I have experienced and it is giving my company and SME Mail server a bad name!

Version 7.0 will have SpamAssassin and ClamAV integrated, and I'm confident it will provide the level of reliability you've come to expect.

[smeghead]

.. Charlie is correct, check to see if clamav and sa are running.  Check to see if the emails have been held up by clamav as problem emails within the system (install isoqlog to check & manage the spooler)

HTH

[lproven]

Er. Thanks for that -- but what is "the paper path"? Sorry, but I don't understand. Do you mean that I should try to audit the papertrail, as we'd call it in England? See what's going where? Well, I would, but I don't know where to look.

The only mail-related addins I have are the user holiday notification module, which also lets me activate Spamassassin, which I had done. It's been working fine for months.

Now mail cannot be sent out to the Internet & inbound emails are not being received.

IMAPD seems to be behaving.

From Thunderbird, I can apparently send, but nothing gets through.

From Outlook, I get an error saying that "the TCP/IP connection was unexpectedly disconnected by the server".

I started looking for log files to tell me what was going on. In maillog I found lots and lots of errors from Spamassassin, like this:

Code: [Select]


Jul  8 01:18:47 server4 spamd[1521]: connection from localhost [127.0.0.1] at port 49201
Jul  8 01:18:47 server4 spamd[13521]: info: setuid to qmaild succeeded
Jul  8 01:18:47 server4 spamd[13521]: Creating default_prefs [/var/qmail/.spamassassin/user_prefs]
Jul  8 01:18:47 server4 spamd[13521]: Cannot write to /var/qmail/.spamassassin/user_prefs: No such file or direct
ory
Jul  8 01:18:47 server4 spamd[13521]: Couldn't create readable default_prefs for [/var/qmail/.spamassassin/user_p
refs]
Jul  8 01:18:47 server4 spamd[13521]: processing message <20050707133941.152C32E2E0A@mra03.ex.eclipse.net.uk> for
 qmaild:401.
Jul  8 01:19:18 server4 spamd[13521]: clean message (1.8/8.0) for qmaild:401 in 30.6 seconds, 130360 bytes.


So I disabled Spamassassin. This means that maillog now contains loads of errors like this instead:

Code: [Select]


Jul 15 08:30:04 server4 spamc[5530]: connect() to spamd at 127.0.0.1 failed, retrying (1/3): Connection refused
Jul 15 08:30:05 server4 spamc[5530]: connect() to spamd at 127.0.0.1 failed, retrying (2/3): Connection refused
Jul 15 08:30:06 server4 spamc[5530]: connect() to spamd at 127.0.0.1 failed, retrying (3/3): Connection refused
Jul 15 08:30:07 server4 spamc[5530]: connection attempt to spamd aborted after 3 retries


I note that there is no such directory as /var/qmail/.spamassassin so I've created one just in case, but for now, I'm happy to leave it off.

I can send messages from one internal user on the SME Server to another & that seems to work fine. Incoming & outgoing are down, though.

I've looking in the smtpfront log as well. It seems to have thousands of entries like this:

Code: [Select]


2005-07-07 11:08:31.912525500 smtpfront-qmail[24371]: Accepted message qp 30562 bytes 9150
2005-07-07 11:08:32.036715500 smtpfront-qmail[24371]: MAIL FROM:<MAILER-DAEMON@oriel.cix.co.uk>
2005-07-07 11:08:32.036719500 smtpfront-qmail[24371]: RCPT TO:<MAILER-DAEMON@oriel.cix.co.uk>
2005-07-07 11:09:03.823517500 smtpfront-qmail[24371]: Accepted message qp 30568 bytes 13974
2005-07-07 11:09:03.982637500 smtpfront-qmail[24371]: MAIL FROM:<MAILER-DAEMON@oriel.cix.co.uk>
2005-07-07 11:09:03.982640500 smtpfront-qmail[24371]: RCPT TO:<MAILER-DAEMON@oriel.cix.co.uk>
2005-07-07 11:09:37.942174500 smtpfront-qmail[24371]: Accepted message qp 30579 bytes 170781
2005-07-07 11:09:38.053584500 smtpfront-qmail[24371]: MAIL FROM:<MAILER-DAEMON@oriel.cix.co.uk>
2005-07-07 11:09:38.053588500 smtpfront-qmail[24371]: RCPT TO:<MAILER-DAEMON@oriel.cix.co.uk>
2005-07-07 11:10:09.836748500 smtpfront-qmail[24371]: Accepted message qp 30589 bytes 13999


I thought maybe there was some spyware on the machines or something but I've scanned them all with the latest Norton AV Pro 2005 & it gives them a clean bill of health. There are only 3 workstations (Win2K) & 2 laptops (WinXP).

Interspersed with this are the occasional real emails:

Code: [Select]


2005-07-15 20:21:57.202190500 tcpserver: status: 1/40
2005-07-15 20:21:57.202296500 tcpserver: pid 9602 from 192.168.0.101
2005-07-15 20:21:57.220961500 tcpserver: ok 9602 0:192.168.0.4:25 :192.168.0.101::4521
2005-07-15 20:21:57.407006500 smtpfront-qmail[9602]: MAIL FROM:<admin@oriel.cix.co.uk>
2005-07-15 20:21:57.408238500 smtpfront-qmail[9602]: RCPT TO:<george@oriel.cix.co.uk>
2005-07-15 20:21:58.645252500 smtpfront-qmail[9602]: MAIL FROM:<admin@oriel.cix.co.uk>
2005-07-15 20:21:58.645732500 smtpfront-qmail[9602]: RCPT TO:<george@oriel.cix.co.uk>
2005-07-15 20:22:01.725352500 smtpfront-qmail[9602]: Accepted message qp 9603 bytes 539
2005-07-15 20:22:02.083070500 smtpfront-qmail[9602]: bytes in: 595 bytes out: 272
2005-07-15 20:22:02.083248500 tcpserver: end 9602 status 0
2005-07-15 20:22:02.083250500 tcpserver: status: 0/40


That one was me. It worked.

But here's one of my inbound ones, I think:

Code: [Select]


2005-07-15 19:45:03.559436500 tcpserver: status: 1/40
2005-07-15 19:45:03.559514500 tcpserver: pid 9356 from 127.0.0.1
2005-07-15 19:45:03.559788500 tcpserver: ok 9356 0:127.0.0.1:25 localhost:127.0.0.1::36645
2005-07-15 19:45:03.595884500 smtpfront-qmail[9356]: MAIL FROM:<liamproven@yahoo.co.uk> BODY=8BITMIME
2005-07-15 19:45:03.595944500 smtpfront-qmail[9356]: RCPT TO:<admin@oriel.cix.co.uk>
2005-07-15 19:45:06.675095500 smtpfront-qmail[9356]: Accepted message qp 9357 bytes 2370
2005-07-15 19:45:06.780390500 smtpfront-qmail[9356]: MAIL FROM:<lproven@hotmail.com>
2005-07-15 19:45:06.780447500 smtpfront-qmail[9356]: RCPT TO:<admin@oriel.cix.co.uk>
2005-07-15 19:45:09.854222500 smtpfront-qmail[9356]: Accepted message qp 9365 bytes 2116
2005-07-15 19:45:09.935420500 smtpfront-qmail[9356]: bytes in: 4540 bytes out: 299
2005-07-15 19:45:09.935604500 tcpserver: end 9356 status 0
2005-07-15 19:45:09.935618500 tcpserver: status: 0/40


That never arrived: not in Outlook 2K by POP3, in Thunderbird 1.0.3 by IMAP, not in Webmail.

I don't know where else to look. Any hints?

[CharlieBrady]

Er. Thanks for that -- but what is "the paper path"? Sorry, but I don't understand. Do you mean that I should try to audit the papertrail, as we'd call it in England? See what's going where?

You've got it.

Well, I would, but I don't know where to look.

On a standard system, it's just smtpfront-qmail to qmail. You'll have to research what happens with any customisation.

So I disabled Spamassassin. This means that maillog now contains loads of errors like this instead:

Code: [Select]


Jul 15 08:30:04 server4 spamc[5530]: connect() to spamd at 127.0.0.1 failed, retrying (1/3): Connection refused
Jul 15 08:30:05 server4 spamc[5530]: connect() to spamd at 127.0.0.1 failed, retrying (2/3): Connection refused
Jul 15 08:30:06 server4 spamc[5530]: connect() to spamd at 127.0.0.1 failed, retrying (3/3): Connection refused
Jul 15 08:30:07 server4 spamc[5530]: connection attempt to spamd aborted after 3 retries


This says that spamd is not running, but something is trying to run spamc. You need to change one of those two things. Presumably there is a bug in the contrib you are using, so forward your information to its author.

[lproven]

I don't understand what "it's just smtpfront-qmail to qmail" means. How can I look and see where mails are going? What logfiles should I examine, where? Can you give me any hints at all? I would be hugely grateful.

I haven't customised this installation above installing the contrib called "Activate SpamAssassin on SME 6.x" from the Contribs/Email page on this site. It's the 1st link.

Spamassassin comes preinstalled on SMES 6, AFAIK. It's just turned off by default. All this contrib does is put a Spamassassin entry in the server manager. I've tried turning it off & on again; it's made no difference, only the error message changed.

I've removed the contrib & rebooted. No difference.

The "Mail: Summarize status of mail queue" screen implies that there are some 1,200 undelivered mails in the system:

Code: [Select]


Log File Analysis
Report generated: Tue 19 Jul 2005 05:46:02 PM BST

messages in queue: 1226
messages in queue but not yet preprocessed: 0

End of Report


I really need to retrieve those 1,226 messages. We've received no new email in a week now and the situation is truly desperate.

[CharlieBrady]

I don't understand what "it's just smtpfront-qmail to qmail" means.

The "paper path". The path by which mails arrive from the Internet and go into mailboxes. In 6.0, smtpfront-qmail accepts the mails from the Internet, via SMTP, and hands them directly to qmail, via the qmail-queue program.

How can I look and see where mails are going? What logfiles should I examine, where?

You can start with the smtpfront-qmail and qmail log files.

Spamassassin comes preinstalled on SMES 6, AFAIK. It's just turned off by default.

No, it's unconfigured, and there's no way to turn it on in SME 6. You need to add a contrib to do that.

All this contrib does is put a Spamassassin entry in the server manager.

No, it also fiddles with one or more configs.

I've tried turning it off & on again; it's made no difference, only the error message changed.

There's likely a bug in the contrib. In general, contribs haven't undergone the level of QA that the main distribution has.

I've removed the contrib & rebooted. No difference.

Removing the contrib and rebooting will not necessarily remove all remnants of its configuration.

The "Mail: Summarize status of mail queue" screen implies that there are some 1,200 undelivered mails in the system:

There is a standard server-manager panel which will summarise the reason that messages are undelivered in the mail queue.

I really need to retrieve those 1,226 messages. We've received no new email in a week now and the situation is truly desperate.

If you fix the problem, the mails will be delivered.

Have you considered hiring a consultant to help you diagnose the problem?

[lproven]

Thanks.

I've resolved this now. The vacation-notification autoresponder was causing a loop - some of its replies were going to an address that was forwarded back to the server. This causes so many messages to be sent that the client's ISP blocked all port 25 traffic /and did not notify my client that they had done so/ for *one week*.

Getting the block removed required me to disable the autoresponder, which was not a problem. After this, once the 1200-odd outgoing mails were delivered, all returned slowly to normal.

And Charlie, I *am* a consultant who the company has hired in to solve the problem. I don't know anyone in this country who is more expert in SMES than I am - not that I claim to be a world-class SMES guru.