0

I am setting up a Windows Server 2012 with IIS for PHP/Mysql-hosting. I soon as I start the SMTP-service (from IIS 6 Manager) the CPU-percentage in Task Manager spikes.

First when I got the server, I saw how it worked, and found out that spam-bots where relaying e-mails through the server. I set the SMTP-service to only allow connections through from localhost/server-ip. And so nothing shows up in the SMTP-service logs.

Could it be possible something is still hitting my server on Port 25, and it reaches the SMTP-service which denies access but still affects CPU? How can I troubleshoot this?

Task manager

Improve this question
13
  • 1
    Wouldn't your firewall logs answer if something is connecting on port 25?
    – Greg Askew
    Sep 21, 2013 at 16:35
  • "IIS SMTP Server is taking too much CPU" is a statement that you've neither quantified or qualified. Just because it's using more CPU then you might expect it to doesn't mean it's using too much CPU. Where is your benchmark? Where are your comparative performance metrics?
    – joeqwerty
    Sep 21, 2013 at 16:56
  • 1
    Run the following from a command prompt: "netstat -a -n -o >c:\netstat.txt" (without the quotes). Then look for connections on Local Address on port 25. When you say you're allowing connections only from localhost, did you configure that restriction on the SMTP server or the Windows firewall? Also, can you block inbound SMTP on your network firewall/router?
    – joeqwerty
    Sep 21, 2013 at 17:38
  • 1
    It sounds like the server is sending email outbound, so it may be that it is being used as an open relay. You're going to have to dig deeper to figure it out. Shut down your PHP/MySQL and see if the SMTP traffic stops. If it does then you know it's your PHP/MySQL that's causing it. If it doesn't then you need to keep looking.
    – joeqwerty
    Sep 21, 2013 at 18:01
  • 1
    Try using Process Explorer to see "inside" that particular service host process to see if you can identify the specific process. You might also try Microsoft Network Monitor to see if you can identify the specific process - technet.microsoft.com/en-us/sysinternals/bb896653.aspx - microsoft.com/en-us/download/details.aspx?id=4865
    – joeqwerty
    Sep 21, 2013 at 18:13

1 Answer 1

Reset to default
0

I found the cause. A lot of connections was made to port 25 on the server. However, after blocking them, the server still continued to send out mail. That was because the dir:

c:\inetpub\mailroot\queue\

had hundreds of thousands of mail queued up, ready to be sent. Emptying that directory, and now SMTP works as it should.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .