Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a problem with emails on my server. Almost all emails have stopped being received or sent.

I have tried flushing the mailq using /usr/sbin/postfix flush but no luck. I think it is connected with the following strange emails appearing in the queue:

C24CAEEBD4F*    1047 Mon Apr 11 07:40:01  root@ip-XXX-XXX-XX-XX.ip.secureserver.net
                                          root@ip-XXX-XXX-XX-XX.ip.secureserver.net

It appears that the entry above is trying to send an email to the server from the server (XXX-XXX-XX-XX= my IP). When the above items are in the mailq, the queue does not flush and no emails are sent or received.

The emails that I have put into the queue look like this: 

3D30DEEBD97*    3282 Mon Apr 11 07:41:05  noreply@mydomain.com
                                          recip@anothersite.com

When the queue only contains the emails I have put in, it works fine. I am using PHP Pear Mail to manage my emails which has been running fine up until now. I am also running Apache 2 (CentOS 5.5).

Does any one know what the strange entries in the mailq are and why they are in there?

Thank you,

Chris.

share|improve this question
Can you post some more log info about these strange mails and a bit more description about who uses the box please ? My first thought was maybe the box has been compromised and my second was Postfix has hit resource limits. Thanks. – Jonathan Ross Apr 11 '11 at 15:04
@Jonathan - Hi. How do I get more info on the strange entries? There are only a handful of mailboxes that use it at. We are not sending a vast number of emails. – Christopher Apr 11 '11 at 15:08
This should do it: cat /var/log/mail.log | grep XXX-XXX-XX-XX where the Xs are the strange IPs. – Jonathan Ross Apr 11 '11 at 15:10
The IP in the mailq is my server's IP. Should it be there? I get the following error with that command : cat: /var/log/mail.log: No such file or directory – Christopher Apr 11 '11 at 15:13

1 Answer

up vote 2 down vote accepted

It looks like Centos logs live here: /var/log/maillog (not mail.log).

I'd expect something like this from your mail logs.

Apr 11 15:22:11 MailBox postfix/qmgr[7061]: 8B48902: from=<me@ross.com>, size=1784, nrcpt=1 (queue active)

Apr 11 15:22:11 MyMailBox postfix/local[7829]: E5E8901: to=<me@gmail.com>, orig_to=<me@me.com>, relay=local, delay=1, delays=0.38/0/0/0.67, dsn=2.0.0, status=sent (forwarded as 8B4902)

Hopefully that will shed some light.

Please be selective about what you paste and keep the lines clear like I've done otherwise I might go cross-eyed :-). You could use pastie.org if it helps.

-- edit --

A couple of things I've spotted:

fatal: main.cf configuration error: mailbox_size_limit is smaller than message_size_limit

warning: /usr/libexec/postfix/local: bad command startup -- throttling

Give me another minute.

share|improve this answer
1  
OK, hopefully this is it: please run postconf -d | grep mailbox_size_limit and copy me to the result. We'll increase mailbox_size_limit in a second once you've passed that on (I found this here: http://syscp-forum.org/index.php?topic=3984.0) – Jonathan Ross Apr 11 '11 at 15:42
1  
Sorry, I think we're cross-posting :-): Can you add mailbox_size_limit = 101200000 to /etc/postfix/main.cf and then run /etc/init.d/postfix restart – Jonathan Ross Apr 11 '11 at 15:47
1  
I wouldn't be too concerned with those mails (unless you're an open relay, you can test here: checkor.com) but more with the fatal error in the logs. Has it stopped appearing now ? Run cat /var/log/maillog | grep fatal on the command line and see when the last fatal entry is. – Jonathan Ross Apr 11 '11 at 15:58
1  
If you see the old value it's probably duplicated in main.cf I would guess. Postfix is pretty clever, just try running postfix reload in case it's not restarting correctly. – Jonathan Ross Apr 11 '11 at 16:01
1  
Okay, a couple of things to check. Please remove your added line and change it to mailbox_size_limit = 0 then postfix reload. – Jonathan Ross Apr 11 '11 at 16:07
show 22 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.