Hi,
I have a postfix-2.8.7 system with fedora15 and amavisd-new-2.6.6.
Lately I have been experiencing significant delays before receiving
the initial postfix 220 greeting from all remote hosts. I've verified
DNS is working properly and can resolve hosts properly. It seems to be
related to system load and doesn't occur as frequently when the server
is less busy.
I've experimented with various parameters but am really unsure where
to start. I was unsure if it was somehow related to
smtpd_client_connection_count_limit or some other limit parameter. My
guess is it's related to not spawning enough smtp processes to accept
the incoming connections?
This issue occurs even when amavisd is otherwise idle, with a least a
few processes idle. This server is a dual quad-core Xeon with 16GB.
I've also enabled debug_peer_list and it really doesn't reveal
anything helpful. I can see the initial postscreen connection, then a
large delay, then immediately the match_hostname, match_hostaddr
statements, and the 220 greeting:
Feb 22 13:14:35 mail01 postfix/postscreen[25319]: CONNECT from
[64.XXX.YYY.2]:48144
Feb 22 13:14:35 mail01 postfix/postscreen[25319]: WHITELISTED
[64.XXX.YYY.2]:48144
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: connect from
rogue.example.com[64.XXX.YYY.2]
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostname:
rogue.example.com ~? 127.0.0.0/8
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostaddr:
64.XXX.YYY.2 ~? 127.0.0.0/8
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostname:
rogue.example.com ~? 192.168.1.0/24
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostaddr:
64.XXX.YYY.2 ~? 192.168.1.0/24
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostname:
rogue.example.com ~? 192.168.6.0/24
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostaddr:
64.XXX.YYY.2 ~? 192.168.6.0/24
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostname:
rogue.example.com ~? 68.XXX.YYY.40/29
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostaddr:
64.XXX.YYY.2 ~? 68.XXX.YYY.40/29
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostname:
rogue.example.com ~? 64.XXX.YYY.0/27
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: match_hostaddr:
64.XXX.YYY.2 ~? 64.XXX.YYY.0/27
Feb 22 13:16:31 mail01 postfix/smtpd[3184]: >
rogue.example.com[64.XXX.YYY.2]: 220 mail01.example.com ESMTP Postfix
I've included my postfinger output below. I also have another issue
that I'm unsure is related. I've had to create a client_checks_special
and sender_checks_special maps, in addition to my normal sender and
client maps, because something in my smtpd_recipient_restrictions was
rejecting my exceptions in those maps before reaching my other
sender_checks and client_checks maps.
postfinger - postfix configuration on Wed Feb 22 13:03:09 EST 2012
version: 1.30
--System Parameters--
mail_version = 2.8.7
hostname = mail01.example.com
uname = Linux mail01.example.com 2.6.42.3-2.fc15.x86_64 #1 SMP Thu Feb
9 01:42:06 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
--Packaging information--
looks like this postfix comes from RPM package: postfix-2.8.7-1.fc15.x86_64
--main.cf non-default parameters--
alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
allow_mail_to_files = alias,forward
always_bcc = bcc-user
biff = no
body_checks = regexp:/etc/postfix/body_checks.pcre
content_filter = smtp-amavis:[127.0.0.1]:10024
debug_peer_list = 64.XXX.YYY.0/27
default_process_limit = 200
delay_warning_time = 4h
disable_vrfy_command = yes
header_checks =
pcre:/etc/postfix/header_checks.pcre
pcre:/etc/postfix/header_checks-jimsun.pcre
initial_destination_concurrency = 20
mailbox_command = /usr/bin/procmail
mailbox_size_limit = 2000000000
manpage_directory = /usr/share/man
maximal_queue_lifetime = 2d
message_size_limit = 13312000
mime_header_checks = pcre:/etc/postfix/mime_header_checks
mydestination = $myhostname, localhost.$mydomain
mynetworks = 127.0.0.0/8, 192.168.1.0/24, 192.168.6.0/24,
68.XXX.YYY.40/29, 64.XXX.YYY.0/27, 206.XXX.YYY.45/32,
167.XXX.YYY.192/26, 74.XXX.YYY.160/27, 67.XXX.YYY.224/28,
160.XXX.YYY.3
postscreen_access_list = permit_mynetworks,
cidr:/etc/postfix/postscreen_access.cidr
postscreen_blacklist_action = enforce
postscreen_dnsbl_action = enforce
postscreen_dnsbl_sites = zen.spamhaus.org*2 bl.spamcop.net*1
b.barracudacentral.org*1
postscreen_dnsbl_threshold = 2
postscreen_greet_action = enforce
rbl_reply_maps = ${stress?hash:/etc/postfix/rbl_reply_maps}
readme_directory = /usr/share/doc/postfix-2.8.7/README_FILES
relay_domains = $mydestination, $transport_maps, example.com,
cs.example.com, hotel.example.com, example.com
sample_directory = /usr/share/doc/postfix-2.8.7/samples
smtpd_recipient_restrictions =
reject_non_fqdn_recipient, check_client_access
hash:/etc/postfix/client_checks_special, check_sender_access
hash:/etc/postfix/sender_checks_special, reject_non_fqdn_sender,
reject_unlisted_recipient, permit_mynetworks,
reject_unauth_destination, reject_unknown_sender_domain,
reject_unknown_recipient_domain, check_helo_access
pcre:/etc/postfix/helo_checks.pcre, reject_invalid_helo_hostname,
check_client_access
hash:/etc/postfix/client_checks, check_sender_access
hash:/etc/postfix/sender_checks, check_recipient_access
pcre:/etc/postfix/relay_recips_segtravel, check_recipient_access
pcre:/etc/postfix/relay_recips_access, check_recipient_access
pcre:/etc/postfix/property_recip_map, check_recipient_access
pcre:/etc/postfix/recipient_checks, check_recipient_access
pcre:/etc/postfix/bwi_relay_recip_checks, check_recipient_access
pcre:/etc/postfix/relay_recips_ecartis, reject_rbl_client
zen.spamhaus.org, reject_rbl_client psbl.surriel.com, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname, mail01.example.com
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_sender_login_mismatch
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem
smtpd_tls_key_file = /etc/pki/dovecot/private/dovecot.pem
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database =
btree:/var/lib/postfix/smtpd_tls_session_cache
smtp_tls_CAfile = /etc/pki/tls/cacert.pem
smtp_use_tls = yes
transport_maps = hash:/etc/postfix/transport
virtual_alias_maps = hash:/etc/postfix/virtual,
hash:/etc/postfix/virtual-segtravel
--master.cf--
submission inet n - n - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
pickup fifo n - n 60 1 pickup
-o content_filter=
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
-o smtp_fallback_relay=
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
smtp-amavis unix - - n - - smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=40
127.0.0.1:10025 inet n - n - 18 smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o
receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o local_header_rewrite_clients=
bwitmp unix - - n - - smtp
-o fallback_relay=[206.XXX.YYY.20]
cstmp unix - - n - - smtp
-o fallback_relay=[206.XXX.YYY.20]
smtp inet n - n - 1 postscreen
smtpd pass - - n - - smtpd
-o receive_override_options=no_address_mappings
dnsblog unix - - n - 0 dnsblog
tlsproxy unix - - n - 0 tlsproxy
-- end of postfinger output --
Thanks,
Alex
