On Wed, January 24, 2018 9:34 am, Noel Jones wrote: > You should grep for "reject:", not error:
Noel, thanks again, (log since Jan 21) # grep '110.170.19.146' /var/log/maillog | grep "lost connection" Jan 22 14:37:02 geko postfix/smtpd[4701]: lost connection after DATA (257981 bytes) from 110-170-19-146.static.asianet.co.th[110.170.19.146] Jan 22 17:05:06 geko postfix/smtpd[13350]: lost connection after DATA (1146873 bytes) from 110-170-19-146.static.asianet.co.th[110.170.19.146] Jan 22 18:28:44 geko postfix/smtpd[18212]: lost connection after DATA (0 bytes) from 110-170-19-146.static.asianet.co.th[110.170.19.146] Jan 23 20:12:45 geko postfix/smtpd[15596]: SSL_accept error from 110-170-19-146.static.asianet.co.th[110.170.19.146]: lost connection Jan 23 20:12:45 geko postfix/smtpd[15596]: lost connection after STARTTLS from 110-170-19-146.static.asianet.co.th[110.170.19.146] Jan 24 13:12:47 geko postfix/smtpd[5216]: SSL_accept error from 110-170-19-146.static.asianet.co.th[110.170.19.146]: lost connection Jan 24 13:12:47 geko postfix/smtpd[5216]: lost connection after STARTTLS from 110-170-19-146.static.asianet.co.th[110.170.19.146] > and a few seconds later STARTTLS succeeds, and that IP successfully sends > mail from user hr@ to 10 recipients. > > Are there many users on that same IP via a NAT? around ~50. they're quite 'remote', server is in Sydney, they're in .th , I'm not sure what sort of connectivity the LAN there has pflogsumm since Jan 21 Host/Domain Summary: Message Delivery -------------------------------------- sent cnt bytes defers avg dly max dly host/domain -------- ------- ------- ------- ------- ----------- 3842 1649m 0 11.0 s 28.4 m tld.com.au
