Koozali.org: home of the SME Server
Legacy Forums => Experienced User Forum => Topic started by: sgt-spam on May 06, 2005, 09:23:03 PM
-
Yesterday morning I got a frantic call from the office (I'm out on leave as my wife and I just had our first child).
Apparently things were 'wacky' with the web / email server (SME 6).
After SSHing the box, I determined there was no free space on /dev/md1. I deleted lots of stuff I was storing there, and usage dropped to below 50% (still more than what it should be).
This morning, I got a call that email was slow. Disk usage is as reported below.
Only changes are a SpamAssassin update (happens automagically). RootKit Hunter says everything's cool. Nothing out of the orginary RE: user mail storage.
What should I check? I'm at a loss, and server performance is going down the tubes.
Thanks!!!
[root@atf-guardian log]# df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/md1 114982144 81541132 27600184 75% /
/dev/md0 101018 14097 81705 15% /boot
none 515096 0 515096 0% /dev/shm
-
check the qmail logs, I bet there is a lot of mail waiting to out. I would also check the workstations for a virus, like Sober.
just where I would start.
-
check the qmail logs, I bet there is a lot of mail waiting to out. I would also check the workstations for a virus, like Sober.
just where I would start.
Outbound message queue looks quite large from the 'report' in server manager. Come to think of it, I changed the failure handling about a week ago. This must be part of the reason.
Is it possible to delete the current outbound queue? I'm up to 80% disk utilization now, and fear I won't make it through the weekend.
-
sgt-spam
>Come to think of it, I changed the failure handling about a week ago.
What did you change ?
> Is it possible to delete the current outbound queue?
Install the qmhandle contrib (search) adds a panel to server manager or use command line to drive it.
man qmhandle (from memory)
I'm up to 80% disk utilization now, and fear I won't make it through the weekend.
Stop your mail system
/etc/init.d/smtpfront-qmail stop
allow system to process messages or delete them
find source of messages eg likely a virus infection on a workstation, remove infection etc, check ALL other w/s's
then
/etc/init.d/smtpfront-qmail restart
Upgrade & improve your virus protection, implement multiple layers for good protection see my post
http://forums.contribs.org/index.php?topic=27251.0
and check the various howtos in my contribs area
http://mirror.contribs.org/smeserver/contribs/rmitchell/smeserver/howto/
and Jespers Knudsens site
-
Thanks for the suggestions...
I've got a couple boxes running 6, and they've been rock solid until this.
Looks like virus activity on a client for sure. I went through my Symantec logs remotely, and the users I suspect thankfully turned off their boxes Friday night.
Basically a couple user's mail accounts were collecting 2MB delivery failure reports - THOUSANDS of them. Obviously this took up a little space and slowed mail delivery locally to a stop.
I cleaned up the mailboxes and created a procmail rule to delete the delivery reports. We're holding steady at about 60% disk usage. I'm not convinced it should be that high, but at least it's not 100%.
I'm using a variety of contribs from many people here: antivirus, spam, etc. Didn't have much luck with the patern matching when I put this box in, but I'll have to spend some time this week updating the server. After I clean up the clients that is. :-|
Again, thanks. :-D