Re: [cobalt-users] Mailq - Total Requests: 330 - what's happening?

[Larry Smith <lesmith@xxxxxxxxx>]

On Tuesday 18 November 2003 16:19, Leo B. wrote:
> A few minutes ago, I received an admin email stating "The CPU is heavily
> loaded." A minute after that I received an email stating "the SMTP (mail)
> server is not responding."
>
> I restarted the email server via the control panel web admin.  And that
> temporarily took care of the problem.  It came back within a few minutes.
> This has happened before, and I remember it having to do with a mailq
> overload.  Currently, when I run "mailq" via SSH, I get a long list of
> mails (at the end it shows: Total Requests: 330).  From the items I can
> scroll up and see, they all seem to be caused by the same problematic email
> address:
>
> hADNG5k32608     7796 Thu Nov 13 15:16 owner-list@xxxxxxxxxxxxxxxx
>                  (Deferred: Connection timed out with isp.net.)
>                                        user@xxxxxxx
>
> Above is an example with the list name and email address changed for
> posting purposes...
>
> We have a few lists on our RaQ that are pretty active... It looks as if
> this email address is causing a lot of problems.  But before trying to
> figure out that issue, how should I proceed cleaning this up?  Is there a
> way to run mailq and have it scroll screen by screen (not all at once), so
> I can verify this one email address is causing all the problems?
>
> Mqueue q1, q2, q3, q4 seem full (there are a bunch of items in all of
> them). I know I can probably just delete them all, however, there may be
> other items in there that are important, right?  Is there any way to delete
> only the email for "user@xxxxxxx" and not mess with other mail?
>
> Would items in the mail queue only be from people using the RaQ as an SMTP
> server?  We don't encourage/allow smtp usage of our raq... So would it make
> sense if I assumed ALL those mails in the mqueue are because of list
> activity?
>
> And finally, does anyone know why this is happening?  Can there be some
> loop error that is not just dumping these emails that are being 'deferred?'
>  Is our system being used by someone else (hacker, etc.)?
>
> I really wish I knew more about linux, logs, email, etc... But
> unfortunately, my knowledge here is not too extensive.
>
> Any help is of course very appreciated.
>
> Thank you,
> Leo

There are probably several things you can do from removing that address from 
the mailing lists and so on, but the quick and dirty of how to get them out 
of the mail queue is easy - just add an "alias" for that mail address that 
points it to something totally (and obviously) bogus.  
	EG no0ne@xxxxxxxxxxxxxxx

Note the zeros instead of o's in c0m and n0where.  this will cause those 
messages to instantly "fail" delivery and they will be bounced to the 
maillist owner.
-- 
Larry Smith
SysAd ECSIS.NET
sysad@xxxxxxxxx