up vote 1 down vote favorite
share [g+] share [fb]

I have a problem with emails on my server. Almost all emails have stopped being received or sent.

I have tried flushing the mailq using /usr/sbin/postfix flush but no luck. I think it is connected with the following strange emails appearing in the queue:

C24CAEEBD4F*    1047 Mon Apr 11 07:40:01  root@ip-XXX-XXX-XX-XX.ip.secureserver.net
                                          root@ip-XXX-XXX-XX-XX.ip.secureserver.net

It appears that the entry above is trying to send an email to the server from the server (XXX-XXX-XX-XX= my IP). When the above items are in the mailq, the queue does not flush and no emails are sent or received.

The emails that I have put into the queue look like this: 

3D30DEEBD97*    3282 Mon Apr 11 07:41:05  noreply@mydomain.com
                                          recip@anothersite.com

When the queue only contains the emails I have put in, it works fine. I am using PHP Pear Mail to manage my emails which has been running fine up until now. I am also running Apache 2 (CentOS 5.5).

Does any one know what the strange entries in the mailq are and why they are in there?

Thank you,

Chris.

link|improve this question
90% accept rate
Can you post some more log info about these strange mails and a bit more description about who uses the box please ? My first thought was maybe the box has been compromised and my second was Postfix has hit resource limits. Thanks. – Jonathan Ross Apr 11 '11 at 15:04
@Jonathan - Hi. How do I get more info on the strange entries? There are only a handful of mailboxes that use it at. We are not sending a vast number of emails. – Christopher Apr 11 '11 at 15:08
This should do it: cat /var/log/mail.log | grep XXX-XXX-XX-XX where the Xs are the strange IPs. – Jonathan Ross Apr 11 '11 at 15:10
The IP in the mailq is my server's IP. Should it be there? I get the following error with that command : cat: /var/log/mail.log: No such file or directory – Christopher Apr 11 '11 at 15:13
feedback

1 Answer

up vote 2 down vote accepted

It looks like Centos logs live here: /var/log/maillog (not mail.log).

I'd expect something like this from your mail logs.

Apr 11 15:22:11 MailBox postfix/qmgr[7061]: 8B48902: from=<me@ross.com>, size=1784, nrcpt=1 (queue active)

Apr 11 15:22:11 MyMailBox postfix/local[7829]: E5E8901: to=<me@gmail.com>, orig_to=<me@me.com>, relay=local, delay=1, delays=0.38/0/0/0.67, dsn=2.0.0, status=sent (forwarded as 8B4902)

Hopefully that will shed some light.

Please be selective about what you paste and keep the lines clear like I've done otherwise I might go cross-eyed :-). You could use pastie.org if it helps.

-- edit --

A couple of things I've spotted:

fatal: main.cf configuration error: mailbox_size_limit is smaller than message_size_limit

warning: /usr/libexec/postfix/local: bad command startup -- throttling

Give me another minute.

link|improve this answer
1  
OK, hopefully this is it: please run postconf -d | grep mailbox_size_limit and copy me to the result. We'll increase mailbox_size_limit in a second once you've passed that on (I found this here: http://syscp-forum.org/index.php?topic=3984.0) – Jonathan Ross Apr 11 '11 at 15:42
1  
Sorry, I think we're cross-posting :-): Can you add mailbox_size_limit = 101200000 to /etc/postfix/main.cf and then run /etc/init.d/postfix restart – Jonathan Ross Apr 11 '11 at 15:47
1  
I wouldn't be too concerned with those mails (unless you're an open relay, you can test here: checkor.com) but more with the fatal error in the logs. Has it stopped appearing now ? Run cat /var/log/maillog | grep fatal on the command line and see when the last fatal entry is. – Jonathan Ross Apr 11 '11 at 15:58
1  
If you see the old value it's probably duplicated in main.cf I would guess. Postfix is pretty clever, just try running postfix reload in case it's not restarting correctly. – Jonathan Ross Apr 11 '11 at 16:01
1  
Okay, a couple of things to check. Please remove your added line and change it to mailbox_size_limit = 0 then postfix reload. – Jonathan Ross Apr 11 '11 at 16:07
show 22 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.