Exim and e-mail attachments

[Oriso]

Hi,

We've been having loads of problems receiving e-mails with attachments since the upgrade of Exim around 9.9.8. The logs are full of these messages each time an attachment is received. This is beginning to be a big problem for our customers. As anyone encountered this ? We tried upping the smtp_receive_timeout in the configuration file, but no luck as of yet. Server is otherwise fine, large files coming in through FTP don't have any such issues.

2005-02-22 05:37:55 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
2005-02-22 06:14:33 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
2005-02-22 06:46:29 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
2005-02-22 07:07:44 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data

[chirpy]

Never seen such problems. Have you tried resetting your exim configuration to defaults incase something has been played with that shouldn't have:

/scripts/reseteximtodefaults

[lloyd_tennison]

What size are the attachments? Are they over your allowed size?

[Oriso]

We didn't reset exim, but we used another box with Postfix and configured it as MX for one of our hosted domains. We then used the transport functionality to redirect e-mails back to the cPanel server. Same problem. So I guess we can rule out cPanel on this one.

Grepping through exim_mainlog I found out that for over 1000 dropped connections, 40% were from the same provider. After discussing with users, it seems most "lost" e-mail where from that provider. So I called them up (big ISP too, just trying to reach someone who cares was hard) and they've had these kinds of problems with their newer spam/anti-virus software software so they'll look into it.

Thanks anyway guys.

[spaceman]

Hi,

We've been having loads of problems receiving e-mails with attachments since the upgrade of Exim around 9.9.8. The logs are full of these messages each time an attachment is received. This is beginning to be a big problem for our customers. As anyone encountered this ? We tried upping the smtp_receive_timeout in the configuration file, but no luck as of yet. Server is otherwise fine, large files coming in through FTP don't have any such issues.

2005-02-22 05:37:55 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
2005-02-22 06:14:33 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
2005-02-22 06:46:29 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
2005-02-22 07:07:44 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data

Any resolution here? We've just discovered the same problem. Our exim_mainlog is full of lines like the above.

We know that many (if not all) of the associated attachments are relatively tiny (e.g. less than 1 Mb).

Help! :-) V. concerned to nail this problem quickly.

[lloyd_tennison]

Is that server (not yours) a slow server? Could Exim be timing out? DO you have any more info as to the message, attachement type, etc.? Maybe should enable extensive logging for a few days to track it down.

Start with:


log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_
interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery
+size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_p
eerdn

and there may be more that may be more specific to your needs.

Or how about capturing the exim output with a verbose (-v) command. Will create huge logfiles - but may be only way.

Also, what anti-SPAM measures are you attempting? Maybe the antivirus or Spam Assassin. going crazy.

[spaceman]

Thanks for all that.

log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_
interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery
+size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn

Q.1 That's all to go in /etc/exim.conf, correct?

Q.2 Would I be correct in saying that, just like httpd.conf, I don't have to stop exim before editing exim.conf, but I do have to stop and restart exim to apply the changes. Correct?

Thank again. I'll get there!

(p.s. our main techie guy is on hols right now, so I'm kind of holding the fort until he gets back)

[spaceman]

Also, yes, we're using the Clam AV, Mailscanner combo on our machine. So I'd say it's quite likely a screwy config in there is causing the problem. We'll see...

[chirpy]

A few things to try:

/scripts/updatenow
/scripts/eximup
/scripts/buildeximconf
/scripts/mailscannerupdate
service exim restart

If you're using my MailScanner script:

/usr/mscpanel/mscheck.pl

[spaceman]

A few things to try:

/scripts/updatenow
/scripts/eximup
/scripts/buildeximconf
/scripts/mailscannerupdate
service exim restart

If you're using my MailScanner script:

/usr/mscpanel/mscheck.pl

Hi Jonathon. Wondered if/when you'd pop up (in the nicest possible way x 10) :-)

At the risk of sounding like a complete girls blouse (for want of a better phrase), can you give a brief description of what each of those commands do, or point me to another post or other url that does. I'm keen to learn what I'm doing before I do them.

Is it fair to assume - and the very fact that you'd mention these scripts implies it is - that running all of these scripts is extraordinarily unlike to break anything?

Yup - it's official - I'm a girls blouse (no disrespect intended to girls or blouses).

p.s. I've started the extra logging in exim.conf after cross checking lloyd_tennison's advice here: http://forums.cpanel.net/showthread.php?t=31034

[chirpy]

Hi,

No problem None of the scripts are likely to break anything, quite the opposite:

/scripts/updatenow - this makes sure that you have the latest /scripts/* files for your release tree

/scripts/eximup - this makes sure that you are running the latest version of exim for your release tree

/scripts/buildeximconf - this rebuilds /etc/exim.conf (and /etc/exim_outgoing.conf if you have MS installed) from the default exim build plus any changes made in the Exim Configuration Editor

/scripts/mailscannerupdate - this ensures that the MS modifications required for exim are included in /etc/eximcofn and /etc/exim_outgoing.conf

service exim restart - this restarts exim

/usr/mscpanel/mscheck.pl - this ensures that all the split spool directories have been created and restarts MailScanner

You might also want to run:

/scripts/mailperm - rebuilds /etc/localdomains and checks file permissions and ownerships on user mail files and exim system files.

[spaceman]

Nice one.

Starting at the top of your list, working down. /scripts/eximup is doing some heavy duty sh1t by the looks of things...

In summary, I guess what you're saying is "Don't try to debug what's going on until you've updated to all relevant software to latest versions. Then check to see if problems persist.". Makes sense to me. :-)

[spaceman]

I've done all that's been suggested so far (thanks!), but it appears that we are still seeing this error, eg:

2005-08-11 18:47:58 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:61641 I=[216.7.176.122]:25 lost while reading message data

Despite adding all the extra reporting into exim.conf, no additional info (over and above what you see above) is available.

I've also checked (grepped) /var/spool/exim_incoming/msglog and /var/spool/MailScanner/quarantine but can't see any further evidence or reporting of what's behind this sort of error.

Starting to run out of options here...

Any takers?

[spaceman]

Latest sample data. Don't think I'm giving away any critical security info by listing this info 'as is' - if someone thinks I am, let me know:

2005-08-11 17:15:14 SMTP connection from (queue04-winn.ispmail.ntl.com) [81.103.221.58] lost while reading message data
2005-08-11 17:28:57 SMTP connection from (soundfinance.com.au) [220.235.40.27] lost while reading message data
2005-08-11 17:54:42 SMTP connection from (mailbo.vtcif.telstra.com.au) [202.12.144.19] lost while reading message data
2005-08-11 17:57:59 SMTP connection from (malcolmsargent.org.au) [203.129.145.102] lost while reading message data (header)
2005-08-11 18:24:14 SMTP connection from (mailbo.vtcif.telstra.com.au) [202.12.144.19]:36507 I=[216.7.176.116]:25 lost while reading message data
2005-08-11 18:36:02 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:56628 I=[216.7.176.122]:25 lost while reading message data
2005-08-11 18:46:21 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:56643 I=[216.7.176.122]:25 lost while reading message data
2005-08-11 18:47:58 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:61641 I=[216.7.176.122]:25 lost while reading message data
2005-08-11 19:47:46 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:38000 I=[216.7.176.122]:25 lost while reading message data
2005-08-11 19:52:55 SMTP connection from (mailbo.vtcif.telstra.com.au) [202.12.144.19]:43519 I=[216.7.176.116]:25 lost while reading message data
2005-08-11 20:36:34 SMTP connection from (216.7.176.116) [212.30.78.95]:1063 I=[216.7.176.116]:25 lost while reading message data (header)
2005-08-11 20:36:58 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:41723 I=[216.7.176.122]:25 lost while reading message data
2005-08-11 20:37:56 SMTP connection from (bland-media.com) [200.75.29.37]:4395 I=[216.7.176.116]:25 lost while reading message data (header)

[chirpy]

To rule out any configuration changes that may have caused the problem, I'd suggest that you try the following that will reset your exim configuration and remove the use of MailScanner completely - this is reversible:

cd /etc
rm -fv exim_outgoing.conf # stops exim from regenerating the files for MS integration
mv exim.conf.local exim.conf.local.old # disables any modifications
/scripts/buildeximconf # generates a clean /etc/exim.conf
service exim restart

Now see if it's OK. If it is, then it#s a configuration problem somewhere. If it is still happening, you could then log a ticket with cPanel as you'll now have a supported configuration.


To get MailScanner back in with your config changes:

cd /etc
mv exim.conf.local.old exim.conf.local
touch exim_outgoing.conf
/scripts/buildeximconf
/scripts/mailscannerupdate
service exim restart