Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: cydonia on December 19, 2004, 06:18:12 AM

Title: Am i being mail bombed?
Post by: cydonia on December 19, 2004, 06:18:12 AM
Something is seriously wrong with my server, i'm not sure what it is really.

SME6ADMIN is sending me alerts every 8 minutes or so telling me that there are like 761 incoming emails and 251 outgoing ones.

Sometimes it has been as high as 1500/500.

Also, CPU utilisation is always at 95-100%

I'm not sure what to do, i am installing the sme plus upgrades which includes spam filters and antivirus, but i will just have to wait to reboot to see if it fixes it, it has installed these two, but it hasn't stopped it so far.

Any ways to stop this?  I don't use the box for email so i was thinking about just blocking the incoming/outgoing mail ports.


Cheers,
Tristan
Title: Am i being mail bombed?
Post by: cydonia on December 19, 2004, 08:36:16 AM
Well, the smeplus update seems to have fixed the problem in some ways, SME6ADMIN is not saying that there are so many mails anymore.

However, my qmail logfile still shows these sorts of entries, and they are non-stop.

2004-12-19 18:40:16.783753500 info msg 455965: bytes 14198 from <> qp 20543 uid 401
2004-12-19 18:40:16.904109500 starting delivery 5162: msg 455965 to remote anonymous@mydomain.homelinux.com
2004-12-19 18:40:16.904121500 status: local 0/10 remote 2/20
2004-12-19 18:40:16.904125500 delivery 5161: success: 192.168.1.1_accepted_message./Remote_host_said:_250_/
2004-12-19 18:40:16.904132500 status: local 0/10 remote 1/20
2004-12-19 18:40:16.904136500 end msg 455474
2004-12-19 18:40:16.977146500 delivery 5162: failure: 192.168.1.1_failed_after_I_sent_the_message./Remote_host_said:_554_This_message_is_looping,_too_many_hops./
2004-12-19 18:40:16.977159500 status: local 0/10 remote 0/20
2004-12-19 18:40:17.177620500 bounce msg 455965 qp 20548
2004-12-19 18:40:17.177630500 end msg 455965
2004-12-19 18:40:17.178548500 new msg 455966
2004-12-19 18:40:17.178553500 info msg 455966: bytes 14746 from <#@[]> qp 20548 uid 406
2004-12-19 18:40:17.354411500 starting delivery 5163: msg 455966 to remote devnull@mydomain.homelinux.com
2004-12-19 18:40:17.354421500 status: local 0/10 remote 1/20
2004-12-19 18:40:17.367788500 delivery 5163: failure: 192.168.1.1_does_not_like_recipient./Remote_host_said:_553_Sorry,_that_is_an_invalid_e-mail_address/Giving_up_on_192.168.1.1./
2004-12-19 18:40:17.367801500 status: local 0/10 remote 0/20
2004-12-19 18:40:17.367805500 triple bounce: discarding bounce/455966
2004-12-19 18:40:17.367810500 end msg 455966


This is so wierd.
Title: Am i being mail bombed?
Post by: cydonia on December 19, 2004, 08:48:56 AM
As usual, this was a result of somethin I the admin had done... :hammer:


I was trying to get a wakeup call agi script for Asterisk to work.  Part of setting up involved creating a crontab to call one of two scripts.

For some reason that was causing my mail problem, i simply deleted the crontab.

How i wish i could stop tinkering with my SME server...:D