Orin,
One phishing spammer has been sending out "killer messages" that cause
queue manager to seize, though in 7.07 it might be the SMTP service that
handles this. I found this last week using 8.15 HF2 and was told by
Ipswitch that this was apparently fixed in 8.21, though the release
notes don't specifically say that the issue was with killer messages.
I won't go into detail here what the killer message looks like, or what
causes the crash since it is a potential DoS exploit, but you should
move all of the files out of your spool and restart the server. Then go
through the messages stuck in your spool and delete all of the files
that are associated with spam, especially the ones that are phishing
related since this is likely the cause.
The only long-term fix is to upgrade to 8.21 or higher. I placed
filters in my system to detect the problematic pattern and delete the
messages with Declude before they hit the Queue Manager, but these
filters are custom and not workable with out of the box Declude
functionality.
The reason why you have the "~" files lining up (and likely some "R"
files) is because they are renamed by IMail when they are about to be
delivered, and that's when the service crashes. Each time it crashes,
it will leave a bunch of these behind, and depending on how your version
operates, it may find the "~" files and rename them to "R" files. You
must remove the offending killer messages from your spool for stable
operation otherwise it will continue to crash.
Take note that I am only guessing that you are experiencing the same
problem. I also believe that a lot of the reported Queue Manager
crashes on the lists in the last few months are the result of this
issue. I'm a little upset that the fix was released without sufficient
detail because I wouldn't have left myself open to this if I had known
about the potential of issues. This is exactly why it is so incredibly
important for a software company to be completely transparent and
extraordinary detailed when it comes to bugs and fixes.
Matt
Orin Wells wrote:
I am hoping one of you more experienced folks has a clue about this
problem and can give me some advice. I don't even know exactly what
is going on let alone where it is happening.
Both last night and again tonight our iMail simply stopped delivering
mail. It appears the messages come into the server OK but they never
leave the queue.
The Spool directory is jammed up with an ever increasing number of
files. I see a lot of files with a leading underscore and file typt
~MP, a lot of GSE files and the log file is way out of kilter. It
normally runs 9 to 10 MB per day but the last two days it is 17 and 25
MB. When I look into the log file I see the following sort of activity
20060323 213530 127.0.0.1 SMTP (3028) requeuing
C:\IMail\spool\QB3561CE200C47A73.GMP R0 T16
20060323 213530 127.0.0.1 SMTP (3028) finished
C:\IMail\spool\QB3561CE200C47A73.GMP status=3
20060323 213530 127.0.0.1 SMTP (3028)
C:\IMail\spool\QB35B1CE200C48DBC.SMP
20060323 213530 127.0.0.1 SMTP (3028) processing
C:\IMail\spool\QB35B1CE200C48DBC.SMP
20060323 213534 127.0.0.1 SMTP (2812) requeuing
C:\IMail\spool\Qc2b317b001067d9b.SMP R0 T18
20060323 213534 127.0.0.1 SMTP (2812) finished
C:\IMail\spool\Qc2b317b001067d9b.SMP status=3
20060323 213534 127.0.0.1 SMTP (2812)
C:\IMail\spool\QC2B717B001068D6A.SMP
20060323 213534 127.0.0.1 SMTP (2812) processing
C:\IMail\spool\QC2B717B001068D6A.SMP
20060323 213538 127.0.0.1 SMTP (2220) requeuing
C:\IMail\spool\QB3EC1CE200C4C3B7.SMP R0 T14
20060323 213538 127.0.0.1 SMTP (2220) finished
C:\IMail\spool\QB3EC1CE200C4C3B7.SMP status=3
20060323 213538 127.0.0.1 SMTP (2220)
C:\IMail\spool\QB3F01CE200C4D51C.SMP
20060323 213538 127.0.0.1 SMTP (2220) processing
C:\IMail\spool\QB3F01CE200C4D51C.SMP
20060323 213543 127.0.0.1 SMTP (2548) requeuing
C:\IMail\spool\QB3601CE200C49F8F.SMP R0 T19
20060323 213543 127.0.0.1 SMTP (2548) finished
C:\IMail\spool\QB3601CE200C49F8F.SMP status=3
20060323 213543 127.0.0.1 SMTP (2548)
C:\IMail\spool\QB3641CE200C4B2B9.GMP
20060323 213543 127.0.0.1 SMTP (2548) processing
C:\IMail\spool\QB3641CE200C4B2B9.GMP
20060323 213543 127.0.0.1 SMTP (2548)
C:\IMail\spool\QB3641CE200C4B2B9.SMP
20060323 213543 127.0.0.1 SMTP (2548) processing
C:\IMail\spool\QB3641CE200C4B2B9.SMP
20060323 213543 127.0.0.1 SMTP (2548)
C:\IMail\spool\QB3691CE200C4C42E.SMP
20060323 213544 127.0.0.1 SMTP (2548) processing
C:\IMail\spool\QB3691CE200C4C42E.SMP
20060323 213544 127.0.0.1 SMTP (2548)
C:\IMail\spool\QB36E1CE200C4D70A.GMP
20060323 213544 127.0.0.1 SMTP (2548) processing
C:\IMail\spool\QB36E1CE200C4D70A.GMP
20060323 213548 127.0.0.1 SMTP (2572) requeuing
C:\IMail\spool\QC4EB17B0010628B9.SMP R0 T15
20060323 213548 127.0.0.1 SMTP (2572) finished
C:\IMail\spool\QC4EB17B0010628B9.SMP status=3
20060323 213548 127.0.0.1 SMTP (2572)
C:\IMail\spool\QC4EF17B0010639A1.SMP
20060323 213548 127.0.0.1 SMTP (2572) processing
C:\IMail\spool\QC4EF17B0010639A1.SMP
20060323 213548 127.0.0.1 SMTP (2572)
C:\IMail\spool\Qc4f317b001064634.SMP
20060323 213548 127.0.0.1 SMTP (2572) processing
C:\IMail\spool\Qc4f317b001064634.SMP
20060323 213548 127.0.0.1 SMTP (2572)
C:\IMail\spool\Qc4f517b001064f0e.SMP
20060323 213548 127.0.0.1 SMTP (2572) processing
C:\IMail\spool\Qc4f517b001064f0e.SMP
20060323 213548 127.0.0.1 SMTP (2572)
C:\IMail\spool\Qc4f917b0010660b1.SMP
20060323 213548 127.0.0.1 SMTP (2572) processing
C:\IMail\spool\Qc4f917b0010660b1.SMP
20060323 213548 127.0.0.1 SMTP (2572)
C:\IMail\spool\Qc4fc17b001066ae3.SMP
20060323 213548 127.0.0.1 SMTP (2572) processing
C:\IMail\spool\Qc4fc17b001066ae3.SMP
20060323 213549 127.0.0.1 SMTP (2572)
C:\IMail\spool\Qc51317b00106c4ab.SMP
20060323 213549 127.0.0.1 SMTP (2572) processing
C:\IMail\spool\Qc51317b00106c4ab.SMP
20060323 213551 127.0.0.1 SMTP (2280) requeuing
C:\IMail\spool\QB3641CE200C4B2B9.GMP R0 T16
20060323 213551 127.0.0.1 SMTP (2280) finished
C:\IMail\spool\QB3641CE200C4B2B9.GMP status=3
20060323 213551 127.0.0.1 SMTP (2280)
C:\IMail\spool\QB3641CE200C4B2B9.SMP
20060323 213551 127.0.0.1 SMTP (2280) processing
C:\IMail\spool\QB3641CE200C4B2B9.SMP
20060323 213559 127.0.0.1 SMTP (2640) requeuing
C:\IMail\spool\QB3BB1CE200C4043F.SMP R0 T16
20060323 213559 127.0.0.1 SMTP (2640) finished
C:\IMail\spool\QB3BB1CE200C4043F.SMP status=3
20060323 213559 127.0.0.1 SMTP (2640)
C:\IMail\spool\QB3C41CE200C4296B.SMP
20060323 213559 127.0.0.1 SMTP (2640) processing
C:\IMail\spool\QB3C41CE200C4296B.SMP
20060323 213602 127.0.0.1 SMTP (2028) requeuing
C:\IMail\spool\QB4A41CE200C4915E.SMP R0 T13
20060323 213602 127.0.0.1 SMTP (2028) finished
C:\IMail\spool\QB4A41CE200C4915E.SMP status=3
20060323 213602 127.0.0.1 SMTP (2028)
C:\IMail\spool\QB4AD1CE200C4B60C.SMP
20060323 213602 127.0.0.1 SMTP (2028) processing
C:\IMail\spool\QB4AD1CE200C4B60C.SMP
I tried to clear this up by stopping and then restarting all the iMail
services. I also tried to stop and start them individually. Neither
approach worked. The only way I have been able to clear it is to
reboot the server. Obviously this is not something I want to have to
do every day.
We are running iMail 7.07 with declude 2.0.6
Any thoughts guys? Is there something going on in iMail world this
week that I missed?
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
