[Mimedefang] Can someone explain this?

David F. Skoll dfs at roaringpenguin.com
Wed Nov 26 13:11:27 EST 2003

On Wed, 26 Nov 2003, Jon R. Kibler wrote:

> We ran into a new problem overnight. Some clown tried a dictionary
> attack against one of our customer's domains. After about 4 tries to
> spam our customer, MD suddenly started gagging (see log
> below). However, after about a minute, everything seemed to correct
> itself. Checking our performance monitoring logs, our load level never
> exceeded 3, cpu utilization never exceeded 8%, we had zero paging and
> disk i/o was less than 10/sec.

What happened was a whole whack of requests came in at around the same time
(notice the time stamp in your logs!) and the listen(2) backlog of the
multiplexor's listening socket was exceeded, so it started rejecting

After a little while, things settled back to normal.



More information about the MIMEDefang mailing list