Multiple Email

[chiefgofor]

Originally posted by Swakoo
Guys... just to update:

I inserted the following control files into /var/qmail/control

timeoutremote - 1200
timeoutsmtpd - 1200
timeoutconnect - 60

Switched off Spamassasin and DrWeb earlier too (it didn't affect the load, but i am not using it anyway)

The load on my server went drastically down!
0.10 on average.. where it used to be 2.5-3.5 average ..

and no more multiple emails... not sure if it is the cause to celebrate... but am still observing...

What do these values do and just how do I set them? Are you still confident that it has solved your issues? Do you know why these setting solve your issues? Thanks Sawkoo!

 

[jamesyeeoc]

Those are files in the /var/qmail/control directory. If they already exist, then just edit them (like with nano, pico, or vi). If they do not exist, then create them (same editors).

Each file would have a single line consisting of the numerical value.

 

[Swakoo]

Originally posted by jamesyeeoc
You didn't post what those timeout values were before you changed them, so I can only speculate endlessly...

Did you resolve the permissions problems? If not, then the RKHunter results may be incomplete or inconclusive.

Previously, I didn't have any of those control files at all. So I wonder how did they affect the problem or rather, help solved it.

I also didn't expect one thing: My spam has dropped considerably. Really by a huge amount...

 

[jamesyeeoc]

Interesting, not sure I can fathom how the timeout values would end up decreasing spam amounts. Although I have noticed that this weekend there has been less in general hitting my servers.

The values you put into the timeout control files appear to be the default values anyways. (so it should not have mattered, if the files do not exist,then those values are pre-set in the qmail modules anyways). Interesting....

 

[Swakoo]

Originally posted by jamesyeeoc
Interesting, not sure I can fathom how the timeout values would end up decreasing spam amounts. Although I have noticed that this weekend there has been less in general hitting my servers.

The values you put into the timeout control files appear to be the default values anyways. (so it should not have mattered, if the files do not exist,then those values are pre-set in the qmail modules anyways). Interesting....

Even without the control files, the settings are there already in the module? HMm then then mystery deepens really because it stopped the multiple email problem of mail sent out, and spam. The load on my server dropped considerably (and spam amount lessen) right after I reset qmail and xinetd after creating those 3 control files....

what do the 3 do exactly?

timeoutconnect
timeoutremote
timeoutsmtpd

time out smtpd I've read, is time to wait for SMTP client. I suppose it refers to my users whose email is in this PLESK box as "client", right?

timeoutconnect and timeoutremote refers to time to wait for SMTP connection and time to wait for remote server respectively. What's the difference?


So far, only one case of multiple emails, and its incoming email (whew) and its to a forwarding account. Forwards to a gmail account.

Via the maillog, it shows only 1 delivery to the [email protected]. But it shows 11 deliveries to [email protected] without any errors reported in between.

You guys have problem with gmail/forwarding accounts?

 

[Swakoo]

back it came

Got one more case of an email sent out by my user which got repeated at the client end. Log shows it sent a couple of time.

Jun 19 09:59:17 ns3 qmail: 1150682357.445843 starting delivery 87109: msg 4669443 to remote private email address
.......................
a few more time the following appeared
Jun 19 09:59:26 ns3 qmail: 1150682366.425987 starting delivery 87110: msg 4669443 to remote private email address
Jun 19 09:59:26 ns3 qmail: 1150682366.426025 status: local 0/10 remote 2/250
Jun 19 09:59:26 ns3 qmail: 1150682366.426046 starting delivery 87111: msg 4669443 to remote private email address
Jun 19 09:59:26 ns3 qmail: 1150682366.426064 status: local 0/10 remote 3/250
Jun 19 09:59:26 ns3 qmail: 1150682366.428596 starting delivery 87112: msg 4669443 to remote private email address
Jun 19 09:59:26 ns3 qmail: 1150682366.428637 status: local 0/10 remote 4/250
Jun 19 09:59:26 ns3 qmail: 1150682366.429225 starting delivery 87113: msg 4669443 to remote private email address
Jun 19 09:59:26 ns3 qmail: 1150682366.429254 status: local 0/10 remote 5/250
..........................................

the above happened a few more times, which i won't repeat. then the message ended. Note the messageID
Jun 19 09:59:46 ns3 qmail: 1150682386.184174 end msg 4669443
.........................................
Interestingly, from here.... the following (with the same ID) repeated. I'm not sure if it is refering to the same message since it is supposed to have ended, but in between there was no new log entry for new mail using same ID. In fact, it was like immediately after it ended...

Jun 19 09:59:46 ns3 qmail: 1150682386.184279 warning: trouble opening remote/6/4669443; will try again later

then many lines down, the following was repeated 9 times before the same messageID was used for a new message

Jun 19 09:59:48 ns3 qmail: 1150682388.294242 warning: trouble marking remote/6/4669443; message will be delivered twice!
Jun 19 09:59:48 ns3 qmail: 1150682388.294262 warning: unable to unlink remote/6/4669443; will try again later
Jun 19 09:59:48 ns3 qmail: 1150682388.294278 status: local 0/10 remote 8/250
Jun 19 09:59:48 ns3 qmail: 1150682388.335827 delivery 87117: success: 203.120.62.163_accepted_message./Remote_host_said:_250_Message_accepted_for_delivery/

What cause the error, what will cause it to "send twice".

First reported case so far... no attachment...

but still.. a problem to be solved.

Anyone?
Thanks!

 

[jamesyeeoc]

timeoutconnect and timeoutremote refers to time to wait for SMTP connection and time to wait for remote server respectively. What's the difference?

From the man pages of qmail-remote:

timeoutconnect - Number of seconds qmail-remote will wait for the remote SMTP server to accept a connection. Default: 60 The kernel normally imposes a 75-second upper limit.

timeoutremote - Number of seconds qmail-remote will wait for each response from the remote SMTP server. Default: 1200

what will cause it to "send twice"

Since the normal qmail processing of the queued message file was not completed, qmail will then automatically retry at a later time.

Regarding the entries in your log 'trouble marking remote' and 'unable to unlink remote' - the only other references to that error I have found so far seem to have been related to firewall, AV, or SA updates/settings.

From the man pages of qmail-log:

trouble marking ...
qmail-send was unable to record the result of a successful or permanently unsuccessful delivery. This means that the delivery will be tried again later.

unable to unlink ...
qmail-send is unable to remove a file. It will try again later.

So if it's not an ownership or permissions problem, or queue corruption, then I'd say take a look at any other package which deals with email handling (av scanner, spamassassin). I suppose if one or the other has the queue file locked, it would prevent qmail from processing the queue message properly.

Just re-skimmed the thread, you never indicated if you had rebuilt the queue or not, so I have to assume that queue corruption may still be a possible factor.

 

[Swakoo]

i have stop SA and DrWeb.. so no other services are running (that I can think of) that is affecting email.

No I haven't do queue rebuilding. Pardon my ignorance, how do I do it...?

 

[Swakoo]

Some updates:

I removed the following control files which I thought was the solution:

timeoutconnect
timeoutremote
timeoutsmtpd

But after removing, my server load is still favourable, not heavy. Weird. I swear that the improvement came in suddenly right after I added those 3 control files with the default values (files weren't in /var/qmail/control/ initially.)

Now monitoring if the spam is increasing....

 

[Swakoo]

spam hasn't increase much... things are still good.

Have about 2 cases of repeated email so far... better than last week but still.. I realise its mails with attachment.

Is there a more recommended settings for the timeout so that it will wait longer before timeout. I suspect that is the problem.. but which control file to change exactly?

 

[jamesyeeoc]

Are you still running the server with AV and SA disabled? If it's only happening with attachment emails, I would wonder if it's something to do with attachment scanning causing delays. ?

How large were the attachments in those emails?

 

[Swakoo]

yup, both drwebd and spamd are switched off.

of the 2 mails, only one has attachments. But those mails that had repeated one in the past were all with attachments.. various sizes.. this latest one is about 3MB

 

[jamesyeeoc]

Is there a more recommended settings for the timeout so that it will wait longer before timeout. I suspect that is the problem.. but which control file to change exactly?

If this were the case, it would most likely be timeoutremote since that affects how long your server will wait for a response from the remote server.

If the remote server is taking long to scan the email message (and/or attachment) then your side would have to wait longer for a reply/acknowledgement.

However, I don't think this is the problem. Your logs show that qmail was trying to mark the message in the queue, which indicates it did get the acknowledgement from the remote SMTP server. My mind is back to 'queue corruption'...

Have you actually checked the 'ps' list to make sure there are not spamd daemons running in memory? (ps -ax |grep spam)

 

[Swakoo]

nope, just check, there's no spam daemon running.

What you reckon can be a safe value to try for timeoutremote?

also what is the way to rebuild the queue..? can do it in the wee hours... but afraid that after i do it, it may have more problems...

 

[jamesyeeoc]

Rebuilding queue: I've seen several methods posted here and on other forums. I'm not sure which method is 'best' or 'safest'.

Always do a complete server backup !!! *before* attempting

1. Rename current queue, force reinstall the PSA qmail rpm

2. Find and try the queue repair utility, I think it's available at qmail.org

3. Check with SWSoft, open a ticket. I believe I may have seen someone post that they emailed him a script to check queue permissions and such (IIRC).

4. Google for other options.

Disclaimer: I am not recommending any of these, just listing options I have seen others try. I am not that level of qmail guru and have never had to do it myself. I do recommend seeking advice from other qmail experts before attempting any of it, just make sure they know you have a PLESK server and what version (this is not the standard qmail source tree). I am not responsible for any damage period.

Actually there was one time, I got around it by restoring from a backup, had to remember to restore ownership info as well as structure/files.

Here is SWSoft's HowTo Rebuild Qmail's Queue
http://kb.swsoft.com/article_22_252_en.html

 

[Swakoo]

I'm going to try the timeoutremote @ 2400s first and see how.

If that can't, i really have to schedule a queue rebuild man....

Btw, how do I backup PLESK effectively...? My server is running on RAID 1 so I haven't backup yet before... pressing the enter key to do it can be quite daunting without experience... heh

 

[jamesyeeoc]

Backups: The only advice I can give is - stay away from Plesk's backup/restore utilities. They are free, but can be problematic (search forum posts...)

Other methods: (not in any particular order or preference)
1. 4PSA's Total Backup
2. Acronis Server backup/image
3. Physical clone to a separate HDD (Acronis, Ghost for Linux, etc)

 

[Swakoo]

Originally posted by jamesyeeoc
Backups: The only advice I can give is - stay away from Plesk's backup/restore utilities. They are free, but can be problematic (search forum posts...)

Other methods: (not in any particular order or preference)
1. 4PSA's Total Backup
2. Acronis Server backup/image
3. Physical clone to a separate HDD (Acronis, Ghost for Linux, etc)

Woah clone the entire hdd huh... think I'll try Acronis, do a whole backup. But Acronis Server backup/image can do linux properly? Heard cases of such software being problematic on Linux. Is it Acronis True Image Server for Linux?

I just realise my repeated mail message ID is always those same few (4669458)... creepy...
sounds like the queue man.. i don't suppose I can just delete that queue folder and let it rebuild...?

I am having much lesser complain of repeated mail, but there's always the odd 1 or 2 complain of 10 repeated mails....

 

[jamesyeeoc]

Contact Acronis sales and explain in much detail what you want to accomplish, they are pretty good at recommending the correct product.... price is a different matter....

If you just delete the queue directory, it will *NOT* auto-rebuild itself.... see the prior post

 

[Swakoo]

hmm, looks like I can't avoid the rebuilding then....

time to set a date