Re: [cobalt-users] Dead Letter Office?

["Kevin D" <kdlists@xxxxxxxxxxxxxxx>]

Cron jobs: /etc/crontab and follow all all files/dirs listed therein

dead.letter files, from my experience, usually happen when a user tries
unsuccessfully to send email. Could somebody be sending huge attachments
that generate these? I would check the mail log /var/log/maillog

SMTP/CPU load issues are something you should search out in the archives.
The usual suspect here is a connection that doesnt terminate properly, which
causes a number of sendmail processes to hang for the default timeout of 60
minutes. When too many processes get started, sendmail goes down.

All of this sounds too strange too be a random system malfunction. You may
have been hacked. The evidence would probably reside in those crontab files
and in the continual sendmail connections.

Kevin

----- Original Message -----
From: "Infinity2" <infinity2@xxxxxxxxxxxx>
To: "Jens Kristian Søgaard" <jens@xxxxxxxxxxxxxxxxxxxx>;
<cobalt-users@xxxxxxxxxxxxxxx>
Sent: Thursday, December 21, 2000 3:27 PM
Subject: Re: [cobalt-users] Dead Letter Office?


> I will try to look at the files contents.
> Everytime I remove it, it just happens again after a while.
> I'm certain our server is not an open relay server.
> All the cronjobs look normal. but where would I check for their cronjobs?
> and what would I be looking for?
>
> Lastly, I failed to mention that this is happening in progression.  First,
> we start getting disk full errors and the dead.letter file.  The next day,
> the cron jobs start popping up.  It didn't all happen at once, it's been
> "progressing".  Not the SMTP service is not working because of the CPU
load.
> Help?
>
> Thanks,
>
> Rob Spurlock
>
> ----- Original Message -----
> From: "Jens Kristian Søgaard" <jens@xxxxxxxxxxxxxxxxxxxx>
> To: <infinity2@xxxxxxxxxxxx>
> Sent: Thursday, December 21, 2000 3:07 PM
> Subject: Re: [cobalt-users] Dead Letter Office?
>
>
> "Infinity2" <infinity2@xxxxxxxxxxxx> writes:
>
> > Help please.  This question is for a RaQ. (yes, the original).  Just
> > recently, we started getting disk full errors.  When I check the df -m,
it
> > shows the /var at 100%.  The culprit is a file called the dead.letter in
> > /var/tmp and it completely fills the rest of /var.  I have also noticed
> that
> > it is spawning all kinds of cron jobs.  Can anyone help me figure out
what
> > is causing this?  It keeps bringing our server down to its knees and
> > customers are getting restless.  Please reply straight to the e-mail
also
> as
>
> Did you try looking the file to determine it's contents?
>
> Did you try removing it?
>
> Are you sure your server is not an open relay?
>
> Have you checked the cronjobs of your customers?
>
>
> --
> Jens Kristian Søgaard, Mermaid Consulting I/S,
> jens@xxxxxxxxxxxxxxxxxxxx,
> http://www.mermaidconsulting.com/
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>