We're on a VPS and lately we've been getting a few 'exim has failed...A restart was attempted automagicly.' messages. Support indicated that we're hitting our limits and suggested that we move to a bigger package or remove accounts. I only have 2 active sites on this account. We're new at this and don't know if there's anything else we can do.
Does anyone know what could be causing exim to fail?
exim queue is always being filled by millions of spam mails...
In 5 minutes more than 1000 messages..
I have removed all several times but they insist in coming back..
In 1 one min:
1Ju7q6-00039t-031mDeleteDeliver Now
ALEXNSONIA@MSN.COM
1Ju7q6-00039w-161mDeleteDeliver Now
ALEXNSTEPH4-1-98@MSN.COM
1Ju7q6-0003A0-2s1mDeleteDeliver Now
ALEXIA27@BELLSOUTH.NET ...
For the last 5 days, exim has been retrying to resend email to a recipent every
1 millisecond.
As result, logs are huge, and load is being affected.
So I'd like to know how can I set/configure exim to ingore sending to any
email I'd tell it.
I mean is there any config file I can look into, to set a ignore list, or even
how to have it so that it retries sending every 1 hour, instead of every 1 millisecond.
I have a busy cpanel mail server
Very often now and then, i have 2 issue coming up:
1. Unroutable E-mail bounce back message
The message looks like this:
you@gmail.com
unrouteable mail domain "gmail.com"
I have already set "unlimited" mail per hour on cpanel itself and it should not be giving me this message but it does again.
2. Exim failed by itself (SMTP Error while sending out e-mail)
I am using Outlook Express & Thunderbird, sometimes while sending out the e-mail, it gives SMTP error popup message.The e-mail was never sent out. I can only solve this problem by restarting exim manually.
What are the permenant solution for both of this issue?
One of my users is receiving way too many Mailer Daemon messages and his mailbox is full. I've had this problem from time to time and I am trying to figure out how to block mailer daemon messages for a specific domain so that they do not even get on the mailing queue...much like when you set a default address to ":fail:". So I came up with this:
refuse_md1:
deny message = The original message did not come from this site.
condition = ${if eq{$sender_address}{}{yes}{no}}
condition = ${if eq{$local_part}{userdomain.com}{yes}{no}}
log_message = Refused a bounce message for userdomain.com
However, this doesn't help. The emails are still going to the mailing queue and when I look at the Exim log I see the usual error message saying that the email was blocked because the account has run out of space.
i have run exim -qff from SSH then i got below error let me know what to do
Code:
root@web [~]# exim -qff
sda7: write failed, user block limit reached.
sda7: write failed, user block limit reached.
sda7: write failed, user block limit reached.
My mail server receives tons of messages directed towards bogus, non-existant addresses at my domain. When those addresses don't exist, it creates a reply email with the subject "Mail delivery failed: returning message to sender". How do I stop exim from doing this?
View 3 Replies View RelatedGetting massive amounts (thousands) of these lines in exim mainlogs and gz exim rotated logs too
Quote:
2009-04-21 09:20:45 [11305] 1LwGq4-0002wL-I3 <= <> R=1LwGq3-0002vw-Fa U=mailnull P=local S=1639 T="Mail delivery failed: returning message to sender" from <> for root@server.domain.com
Of course, the time is different (several days)
How can trace who / where this is coming from?
Its a cpanel box with suphp enabled, and all the exim tweaks you can imagine (ie, prevent nobody sender, max 50 mails per domain per hour, send callouts disabled, etc)
I have just noticed that for several days I'm constantly receiving these infos in /var/log/messages. I haven't done anything that would invoke them. How can I disable these messages? Are they anything to worry about?
Code:
Feb 6 14:28:18 server kernel: [<c014f600>] find_extend_vma+0x12/0x4f
Feb 6 14:28:18 server kernel: [<c0134383>] get_futex_key+0x39/0x108
Feb 6 14:28:18 server kernel: [<c011d305>] finish_task_switch+0x30/0x66
Feb 6 14:28:18 server kernel: [<c02cf618>] schedule+0x844/0x87a
Feb 6 14:28:18 server kernel: [<c027734b>] sys_socketcall+0x1df/0x1fb
Feb 6 14:28:18 server kernel: [<c0125bc5>] sys_gettimeofday+0x53/0xac
Feb 6 14:28:18 server kernel: [<c02d137f>] syscall_call+0x7/0xb
Feb 6 14:28:18 server kernel: [<c02d007b>] _read_lock_irq+0x4/0x1e
Feb 6 14:28:18 server kernel: Badness in dst_release at include/net/dst.h:149
Feb 6 14:28:18 server kernel: [<f8d8a555>] ip6_push_pending_frames+0x340/0x369 [ipv6]
Feb 6 14:28:18 server kernel: [<f8d9883f>] udp_v6_push_pending_frames+0x169/0x185 [ipv6]Badness in dst_release at include/net/dst.h:149
Feb 6 14:28:18 server kernel: [<c0278fa8>]
Feb 6 14:28:18 server kernel: [<f8d98e7d>] udpv6_sendmsg+0x622/0x770 [ipv6]
Feb 6 14:28:18 server kernel: [<c027a498>] __kfree_skb+0x55/0xf7
Feb 6 14:28:18 server kernel: [<c027e1b8>] skb_dequeue+0x40/0x46
Feb 6 14:28:18 server kernel: [<c027b009>] net_tx_action+0x60/0xfc
Feb 6 14:28:18 server kernel: [<c0126354>] skb_recv_datagram+0x61/0x9b
Feb 6 14:28:18 server kernel: [<c02b1ed7>] __do_softirq+0x4c/0xb1
Feb 6 14:28:18 server kernel: [<c010814b>] do_softirq+0x4f/0x56
Feb 6 14:28:18 server kernel: =======================
Feb 6 14:28:18 server kernel: [<c0107a60>] do_IRQ+0x1a2/0x1ae
Feb 6 14:28:18 server kernel: [<c02d1d3c>] udp_recvmsg+0x5f/0x271
Feb 6 14:28:18 server kernel: [<c02b7b35>] common_interrupt+0x18/0x20
Feb 6 14:28:18 server kernel: [<c02d007b>] inet_sendmsg+0x38/0x42
Feb 6 14:28:18 server kernel: [<c02757f5>] _read_lock_irq+0x4/0x1e
Feb 6 14:28:18 server kernel: sock_sendmsg+0xdb/0xf7
Feb 6 14:28:18 server kernel: [<c02757f5>] sock_sendmsg+0xdb/0xf7
Feb 6 14:28:18 server kernel: [<c011fee1>] autoremove_wake_function+0x0/0x2d
Feb 6 14:28:18 server kernel: [<c027a89e>] verify_iovec+0x76/0xc2
Feb 6 14:28:18 server kernel: [<c0276f44>] sys_sendmsg+0x1ee/0x23b
Feb 6 14:28:18 server kernel: [<c011cb7d>] activate_task+0x88/0x95
Feb 6 14:28:18 server kernel: [<c011d00a>] try_to_wake_up+0x225/0x230
Feb 6 14:28:18 server kernel: [<c011d00a>] try_to_wake_up+0x225/0x230
Feb 6 14:28:18 server kernel: [<c0170776>] inode_update_time+0x80/0x87
Feb 6 14:28:18 server kernel: [<c0164748>] pipe_writev+0x310/0x31c
Feb 6 14:28:18 server kernel: [<c02cf622>] schedule+0x84e/0x87a
Feb 6 14:28:18 server kernel: [<c027734b>] sys_socketcall+0x1df/0x1fb
Feb 6 14:28:18 server kernel: [<c0125bc5>] sys_gettimeofday+0x53/0xac
Feb 6 14:28:18 server kernel: [<c02d137f>] syscall_call+0x7/0xb
Feb 6 14:28:18 server kernel: [<c02d007b>] _read_lock_irq+0x4/0x1e
Feb 6 14:28:18 server kernel: Badness in dst_release at include/net/dst.h:149
Feb 6 14:28:18 server kernel: [<f8d98ef7>] udpv6_sendmsg+0x69c/0x770 [ipv6]
Feb 6 14:28:18 server kernel: [<c027a498>] skb_dequeue+0x40/0x46
Feb 6 14:28:18 server kernel: [<c027b009>] skb_recv_datagram+0x61/0x9b
Feb 6 14:28:18 server kernel: [<c02b1ed7>] udp_recvmsg+0x5f/0x271
Feb 6 14:28:18 server kernel: [<c02b7b35>] inet_sendmsg+0x38/0x42
Feb 6 14:28:18 server kernel: [<c02757f5>] sock_sendmsg+0xdb/0xf7
Feb 6 14:28:18 server kernel: [<c02757f5>] sock_sendmsg+0xdb/0xf7
Feb 6 14:28:18 server kernel: [<c011fee1>] autoremove_wake_function+0x0/0x2d
Feb 6 14:28:18 server kernel: [<c027a89e>] verify_iovec+0x76/0xc2
Feb 6 14:28:18 server kernel: [<c0276f44>] sys_sendmsg+0x1ee/0x23b
Feb 6 14:28:18 server kernel: [<c011cb7d>] activate_task+0x88/0x95
Feb 6 14:28:18 server kernel: [<c011d00a>] try_to_wake_up+0x225/0x230
Feb 6 14:28:18 server kernel: [<c011d00a>] try_to_wake_up+0x225/0x230
Feb 6 14:28:18 server kernel: [<c0170776>] inode_update_time+0x80/0x87
Feb 6 14:28:18 server kernel: [<c0164748>] pipe_writev+0x310/0x31c
Feb 6 14:28:18 server kernel: [<c02cf622>] schedule+0x84e/0x87a
Feb 6 14:28:18 server kernel: [<c027734b>] sys_socketcall+0x1df/0x1fb
Feb 6 14:28:18 server kernel: [<c0125bc5>] sys_gettimeofday+0x53/0xac
Feb 6 14:28:18 server kernel: [<c02d137f>] syscall_call+0x7/0xb
Feb 6 14:28:18 server kernel: [<c02d007b>] _read_lock_irq+0x4/0x1e
I am having issues in receieving emails. For some reason, the rbl lists I had setup are causing the server to reject emails (retry - timeout). So, I need to take this rbl list completely. How can I do that? exim.conf is locked and using the advanced editor is no fun even though I tried it putting the dnslists without the rbl causing the problem.
View 3 Replies View RelatedWhat does the #53 mean at the end of the following?
Code:
Mar 25 04:28:23 gamma named[9887]: lame server resolving 'xxxxx.com' (in 'xxxxx.com'?): 207.58.185.160#53
I need to backup some emails from my VPS, Can you please tell me where my emails are stored, I have a VPS running CENTOS, PLESK and POSTFIX mail server.
View 1 Replies View RelatedMy messages logs are full with the following:
Aug 16 05:45:08 sml101 sshd(pam_unix)[23100]: check pass; user unknown
Aug 16 05:45:08 sml101 sshd(pam_unix)[23100]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:13 sml101 sshd(pam_unix)[23119]: check pass; user unknown
Aug 16 05:45:15 sml101 sshd(pam_unix)[23119]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:18 sml101 sshd(pam_unix)[23161]: check pass; user unknown
Aug 16 05:45:18 sml101 sshd(pam_unix)[23161]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:21 sml101 sshd(pam_unix)[23178]: check pass; user unknown
Aug 16 05:45:21 sml101 sshd(pam_unix)[23178]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:24 sml101 sshd(pam_unix)[23187]: check pass; user unknown
Aug 16 05:45:24 sml101 sshd(pam_unix)[23187]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:27 sml101 sshd(pam_unix)[23235]: check pass; user unknown
Aug 16 05:45:27 sml101 sshd(pam_unix)[23235]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:29 sml101 sshd(pam_unix)[23249]: check pass; user unknown
Aug 16 05:45:29 sml101 sshd(pam_unix)[23249]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:32 sml101 sshd(pam_unix)[23262]: check pass; user unknown
Aug 16 05:45:32 sml101 sshd(pam_unix)[23262]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:35 sml101 sshd(pam_unix)[23283]: check pass; user unknown
Aug 16 05:45:35 sml101 sshd(pam_unix)[23283]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:38 sml101 sshd(pam_unix)[23307]: check pass; user unknown
Aug 16 05:45:38 sml101 sshd(pam_unix)[23307]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Aug 16 05:45:40 sml101 sshd(pam_unix)[23321]: check pass; user unknown
Aug 16 05:45:40 sml101 sshd(pam_unix)[23321]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.111.176.1$
Does anyone know what the following events in /var/log/messages mean. It looks like some sort of failure on the ata bus. Does the last line mean that it successfully wrote all data using the cache, or could there be data loss?
The output of smartctl looks ok for the disk.
Code:
Jul 26 16:44:35 server1 kernel: ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x2 frozen
Jul 26 16:44:35 server1 kernel: ata1.00: cmd c8/00:08:9d:e2:8a/00:00:00:00:00/ec tag 0 cdb 0x0 data 4096 in
Jul 26 16:44:35 server1 kernel: res 40/00:01:00:4f:c2/00:00:00:00:00/00 Emask 0x4 (timeout)
Jul 26 16:44:42 server1 kernel: ata1: port is slow to respond, please be patient (Status 0xd0)
Jul 26 16:45:05 server1 kernel: ata1: port failed to respond (30 secs, Status 0xd0)
Jul 26 16:45:05 server1 kernel: ata1: soft resetting port
Jul 26 16:45:10 server1 kernel: ata1.00: revalidation failed (errno=-2)
Jul 26 16:45:10 server1 kernel: ata1: failed to recover some devices, retrying in 5 secs
Jul 26 16:45:15 server1 kernel: ata1: soft resetting port
Jul 26 16:45:15 server1 kernel: ata1.00: configured for UDMA/133
Jul 26 16:45:15 server1 kernel: ata1: EH complete
Jul 26 16:45:15 server1 kernel: SCSI device sda: 976773168 512-byte hdwr sectors (500108 MB)
Jul 26 16:45:15 server1 kernel: SCSI device sda: drive cache: write back
I have a VPS with Future Hosting and recently I have been getting more and more notifications from LFD regarding high CPU load. For example:
Time: Sun Jun 14 06:50:48 2009 -0500
1 Min Load Avg: 9.47
5 Min Load Avg: 6.25
15 Min Load Avg: 3.68
Running/Total Processes: 2/105
I am getting at least one of these a day now and I am also getting alerts about services failing, SPAMD in particular but also EXIM (and messages about LFD being unable to determine the exim queue length). External monitors are also warning me about SMTP timeouts during the same time period that I get the "high load" errors.
Tech support seems a bit stumped by this one and ALWAYS come back with "load looks fine right now". With the frequency of the warning emails increasing I am getting very concerned about the stability of my VPS.
I am not running anything significant on my VPS yet with minimal visitors and load (RAM usage consistently stays below 300MB on a VPS with 1+GB RAM.
Is there any way with mysql 5.0 to send query and slow
log messages (e.g. mysql-slow log and/or mysql-query
log messages) to syslog ?
I want to visualize my mysql report online. ( like use Rsyslog )
Few days back i began to have problem with server overload, when i checked in /var/log/messages i found a lot of
Jun 28 14:17:59 secure named[3523]: client 200.48.225.146#59035: error sending response: host unreachable
Jun 28 14:17:59 secure named[3523]: client 200.51.211.5#32774: error sending response: host unreachable
Jun 28 14:17:59 secure named[3523]: client 202.55.145.3#32637: error sending response: host unreachable
Jun 28 14:17:59 secure named[3523]: client 66.245.177.163#3936: error sending response: host unreachable
Jun 28 14:17:59 secure named[3523]: client 202.59.163.2#32768: error sending response: host unreachable
Jun 28 14:17:59 secure named[3523]: client 216.247.37.56#24990: error sending response: host unreachable
Jun 28 14:17:59 secure named[3523]: client 194.18.168.184#39718: error sending response: host unreachable
Jun 28 14:17:59 secure named[3523]: client 64.226.28.70#45706: error sending response: host unreachable
all at the same hour,minutes and seconds, this that i wrote is an example (the ip's are reals) but like it i found a lot of more, and is in the same time that the server overload. the server is RHE and i have APF and BFA installed.
Where can I turn off the emails that go out in response to a message not being delivered?
View 2 Replies View RelatedI just ran 'rkhunter -c --quiet' and this is the error messages I got:
Line:
Warning: This operating system is not fully supported!
Line: Warning: This operating system is not fully supported!
Warning: Cannot find md5_not_known
Some errors has been found while checking. Please perform a manual check on this machine debian
Is this something I should be worried about??
I'm running CentOS 5.
It appears that MSN / Hotmail have recently began blocking an awful lot of servers I manage. Several of them (for a company I work for) are in a few blacklists however a number of the IP addresses I manage are 100% clean.
Anyone know of something MSN/Hotmail recently began enforcing?
The blocks began at around 6 PM EST on Thursday of last week.
The error message is as follows:
Your e-mail was rejected for policy reasons on this
gateway. Reasons for rejection may be related to content such as obscene
language, graphics, or spam-like characteristics (or) other reputation
problems. For sender troubleshooting information, please go to
http://postmaster.msn.com. Please note: if you are an end-user please
contact your E-mail/Internet Service Provider for assistance.
I feel like a pawn for asking this on WHT but from what I can see
it's fairly widespread.
The domains in question do have basic SPF implemented as well.
not limited to a contact at hotmail / msn that would enjoy a phonebeating.
we send mailing tih php through smtp connection
All ok in the last 5 month
But now when set more than 1000 emails x sessione (any 10 minutes) we get this error:
"421 too many messages in this connection"
There aren't new configuration on exim.
So we have set 1000 emails max and lower minutes in the session (5) but there is another problem:
Warning: fsockopen() [function.fsockopen]: unable to connect to mx.***.com:25 in /home/***.php on line 47
Connection refused (111)
Can be too lower 5 minutes?
I am on a DirectAdmin server, with root access. Exim mail server.
Is there any way to filter outgoing messages? Let's say if IP of client is listed in blacklist, they can not send out emails
messages such as
Apache/2.2.6 (Unix) mod_ssl/2.2.6 OpenSSL/0.9.7a FrontPage/5.0.2.2635 mod_bwlimited/1.4 mod_jk/1.2.25 mod_mono/1.2.4 mod_auth_passthrough/2.1 PHP/5.2.4
when you go to browse a folder with no index file..
is there away to remove this?
/var/log/messages is full of messages like this every 5 minutes:
[INFO] New connection from 209.85.4.32
pure-ftpd: (?@209.85.4.32) [INFO] Logout
is there any way to stop it?
Quote:
Feb 19 15:57:39 server proftpd[1363]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 16:06:02 server proftpd[1982]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 16:06:02 server proftpd[1982]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 16:14:24 server proftpd[2471]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 16:14:24 server proftpd[2471]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 16:22:46 server proftpd[3062]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 16:22:46 server proftpd[3062]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 16:31:09 server proftpd[3696]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 16:31:09 server proftpd[3696]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 16:39:31 server proftpd[4185]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 16:39:31 server proftpd[4185]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 16:47:53 server proftpd[4946]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 16:47:53 server proftpd[4946]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 16:56:16 server proftpd[5495]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 16:56:16 server proftpd[5495]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 17:04:38 server proftpd[6206]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 17:04:38 server proftpd[6206]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 17:13:00 server proftpd[6661]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 17:13:00 server proftpd[6661]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
Feb 19 17:21:23 server proftpd[7225]: server.com (127.0.0.1[127.0.0.1]) - FTP session opened.
Feb 19 17:21:23 server proftpd[7225]: server.com (127.0.0.1[127.0.0.1]) - FTP session closed.
I see over a few hundred of these lines in /var/log/messages. The timestamp is exactly the same for every 2 lines (Proftp session- Opened and Closed). It's occuring every hour of the day. Is someone attacking the ftp daemon or something?