[Mimedefang] mimedefang in endless loop (socketpair)

[Paul Murphy]

Tomasz,

> May 22 15:46:24 statek sendmail[14281]: k4MDkN1J014281:
> 	from=<>, size=3019, class=0, nrcpts=0, proto=ESMTP, daemon=MTA,
> 	relay=smtp11.wanadoo.fr [193.252.22.31]
> May 22 15:46:24 statek sendmail[14281]: k4MDkN1J014281:
> 	<l at batory.org.pl>... User unknown

Looks like normal activity - someone sending via the Wanadoo server in France
is attempting to send you lots of mail for an unknown user, and your system
is correctly processing them and returning the user unknown error.

If there are a lot of these, you will run out of slaves and/or Sendmail
resources and start rejecting mail connections, which is normal behaviour to
avoid killing your system.

The key fact here is that you are seeing lots of messages to this address,
but all with different message IDs - in your post, the "lsof" listing shows
this:

	/var/spool/MIMEDefang/mdefang-k4MDkN1J014281/HEADERS (deleted)
	/var/spool/MIMEDefang/mdefang-k4MDkN1J014281/COMMANDS (deleted)
	/var/spool/MIMEDefang/mdefang-k4MDkNAw014242/HEADERS (deleted)
	/var/spool/MIMEDefang/mdefang-k4MDkNAw014242/COMMANDS (deleted)
	/var/spool/MIMEDefang/mdefang-k4MDkNfs014278/HEADERS
	/var/spool/MIMEDefang/mdefang-k4MDkNfs014278/COMMANDS

There are three messages IDs here (the parts starting k4MDkN...), and this
slave has processed all three - I'm not sure why the old file handles are
still shown as active, but if they are cleaned up later, I'd not worry about
it.

Best Wishes,

Paul.

-- 
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.392 / Virus Database: 268.7.0/345 - Release Date: 22/05/2006