421 Too many concurrent SMTP connections; please try again later

[DWHS.net]

Anyone know what causes the server to have too many concurrent SMTP connections?

Is it the firewall or just exim preset limit. Some sending emails are failing from this.

[JPC-Martin]

It means that there are to many open SMTP connections either incoming or
outgoing.The default is 20, you can raise that with the smtp_accept_max
command in your configuration file.

you can check connections through command:

cat /etc/exim.conf |grep smtp_accept_max

[DWHS.net]

It means that there are to many open SMTP connections either incoming or
outgoing.The default is 20, you can raise that with the smtp_accept_max
command in your configuration file.

you can check connections through command:

cat /etc/exim.conf |grep smtp_accept_max

Thank you, it was set for 100 I changed it to 150, I wonder what is connecting so much. I will have to do some investigating. Maybe a script that sends mail through smtp ?

[DWHS.net]

Is there a way to see who is connecting so much? I have raised it to 250 and still get too many connections.

[mtindor]

There are a gazillion different ways to check. For now, do this from time to time from a shell:

netstat -plan|grep ':25'|grep ESTAB

That will show the IP addresses connected to/from TCP port 25 at any given time. It'll change by the second. But if you have 250+ connections and you think there is likely tons of connections from or to single source, you'll be able to see that easily. Then figure out why that IP address is connecting so much.

grep xxx.xxx.xxx.xxx /var/log/exim_mainlog

Again, there are a gazillion ways to do this, I'm not saying this is best but I know that in a split second this is what would come to mind if I wanted to start figuring out what was going on.

Mike

[acenetgeorge]

We had a similar problem, but keeping an eye on our exim_mainlogs showed the same domains popping up on multiple servers, causing the 421 error. We eventually had to block their IPs in our firewall, as all the email we were getting from them appeared to be spam.

Since we blocked those IPs, we hardly ever have this error anymore. Now whenever we see repeated 421 errors on our servers, we grep the exim_mainlog for 'concurrent', and see if we are receiving tons of mail from the same domain.