[Mimedefang] Undelivered messages
Roberto Machado
racm at centroin.com.br
Wed Feb 27 14:36:12 EST 2002
Hi!
I'm facing a problem here that I can't diagnose. Every now an then, a
message gets stucked in the queue of our external smtp server (there
is an external server, which receives electronic mail from the
internet, and an internal server with the user accounts. The external
forwards the mail to the internal).
Looking in the queue, it shows up like this:
/usr/home/rcrivano/msgs-prob/1 (1 request)
-----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-----------
g1PEieW9022294 635111 Mon Feb 25 11:44 <racm at centroin.com.br>
(Deferred: 451 4.7.1 Please try again later)
<rcrivano at modulo.com.br>
Total requests: 1
When I try to run this message separately, what I see is the external
server trying to deliver to the internal server, a large increase in
the CPU usage of the internal server (consumed by a mimedefang and
sendmail process), like this:
load averages: 2.44, 1.38, 1.33
99 processes: 4 running, 94 sleeping, 1 zombie
CPU states: 21.0% user, 0.0% nice, 77.6% system, 0.0% interrupt, 1.4% idle
Memory: Real: 239M/280M Virt: 287M/860M Free: 40M
PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND
1417 mimedefa 98 0 276K 368K run/0 0:26 53.37% 53.37% mimedefang
6255 root 2 0 2284K 864K run/0 0:09 19.64% 18.80% sendmail
13392 root 2 0 101M 206M sleep 94:31 1.76% 1.76% squid
6381 mimedefa 2 0 4444K 4700K sleep 0:01 0.75% 0.63% mimedefang.pl
[...]
Logfile shows this:
Feb 27 15:57:16 angel sendmail[29543]: g1RIvFUT029543: \
from=<racm at centroin.com.br>, size=635998, class=0, nrcpts=1, \
msgid=<OF4363572E.55014F32-ON03256B6B.00515A65 at grupobimbo.com>, \
proto=ESMTP, daemon=MTA, relay=mingus.modulo.com.br [200.214.72.2]
Feb 27 15:57:16 angel rcrivano[60]: mimedefang-multiplexor: Starting \
slave 1 (pid 29547) (2 running): About to perform scan
Feb 27 15:57:17 angel rcrivano[60]: mimedefang.pl[29327]: Anexo \
removido: 10rosas.pps. From: <racm at centroin.com.br> (*)
Feb 27 15:57:18 angel rcrivano[60]: mimedefang.pl[29327]: filter: \
g1RIvFUT029543: drop_with_warning=1
Feb 27 15:57:18 angel sendmail[29543]: g1RIvFUT029543: Milter message: body replaced
Feb 27 15:59:18 angel sendmail[29543]: g1RIvFUT029543: Milter (mimedefang): timeout during data read
Feb 27 15:59:18 angel sendmail[29543]: g1RIvFUT029543: Milter (mimedefang): to error state
Feb 27 15:59:18 angel sendmail[29543]: g1RIvFUT029543: Milter: data, reject=451 4.7.1 Please try again later
Feb 27 15:59:18 angel sendmail[29543]: g1RIvFUT029543: \
to=<rcrivano at modulo.com.br>, delay=00:02:03, \
pri=30887, stat=Please try again later
(*) this line is a custom message I created using the syslog call.
The 2 minutes timeout is compatible with my sendmail.cf definition:
Xmimedefang, S=unix:/var/mimedefang/mimedefang.sock, F=T, T=S:120s;R:120s;E:5m
However, I tried to increase the 120s to 5m, and the timeout still
occured.
The messages always contain a prohibited attachment (to our policy),
and the action_drop_with_warning() is called.
Maybe this isn't a typical situation, since maybe it's not everybody
who runs 2 servers for internet mail. Is anyone seeing repetitive
4.7.1 messages in their logs, associated with
action_drop_with_warning()? May I send the message in sendmail queue
format so that you can try to reproduce somewhere? Any tips to dig it
further?
Regards,
Roberto
More information about the MIMEDefang
mailing list