Exim keeps failing?

[snet]

Hello,

On one of my cPanel servers exim keeps failing. I keep on getting the following emails about one every 50 minutes:

exim failed @ Wed Feb 15 14:03:35 2006. A restart was attempted automagicly.

How can I find out what is causing exim to fail and how can I fix this?


Thanks.

[chirpy]

You need to look in the exim log files. The exim_mainlog contains all the transaction details. Normally, the exim_paniclog will have a filtered list of major events. Also, if you have something like PRM installed, make sure it isn't that killing it off.

[snet]

Hello Chirpy,

I have looked in both exim_mainlog and exim_paniclog but there is so much stuff in them that it is hard to find anything. What sort of stuff should I be looking for in these files?

[chirpy]

Your exim_paniclog should be almost empty since only the most serious errors go into it. You're simply going to have to match up the time of the restart of exim less ~0-10 minutes and look through errors. As I also mentioned, you should check if you have any processing killing apps installed too.

[snet]

I am not running anything like PRM on this server. Exim has just failed again and I looked at the exim_mainlog file and around the time it failed there is a bunch of lines like the following:

2006-02-17 09:55:57 SMTP connection from (mx.p*t*o*e*m*r*u*.ru) [62.*3*.6.*0] closed after SIGTERM

(Hostname and IP address edited out for privacy)

And then after all of these lines is says:

2006-02-17 09:55:58 exim 4.52 daemon started: pid=24767, -q1h, listening for SMTP on port 25 (IPv4)

I guess this bit is when cPanel restarts exim. Before the "SIGTERM" lines there is nothing unordinary, just loads of lines like this:

2006-02-17 09:55:56 Connection from [195.**.**.17] refused: too many connections

And a few others that are repeated throughout the log file.

Any ideas?

[chirpy]

It's probably this:

2006-02-17 09:55:56 Connection from [195.**.**.17] refused: too many connections

Which looks like someone running a DOS against exim, unless you recognise the IP address. If not, block it in iptables. Do you have any custom ACL's in the exim configuration? If so, make sure that none of them use delay

[snet]

Originally Posted by chirpy

Which looks like someone running a DOS against exim, unless you recognise the IP address. If not, block it in iptables.

I don't recognise the IP addresses, each one is completely random, the same IP address isn't repeated once.

Originally Posted by chirpy

Do you have any custom ACL's in the exim configuration? If so, make sure that none of them use delay

I don't think so, I believe exim is running with the stock config at the moment.

[chirpy]

Have you:

1. Made sure any instances of :blackhole: are replace with :fail: in /etc/valiases/*

2. Installed a dictionary attack ACL:
http://www.configserver.com/free/eximdeny.html

That will usually free up a lot of such connections.

Ultimately, if you genuinly have a very busy email server (it would have to be very busy) you could increase the smtp connections available, but what you're seeing is usually indicative of mis-use of the SMTP server in some manner.

[snet]

Hi Chirpy,

Thanks for your help so far. I have done these 2 things, following the instructions exactly, and exim still fails every 40-50 minutes. Is there anything else I can do to fix this?

[goodmove]

Originally Posted by chirpy

Ultimately, if you genuinly have a very busy email server (it would have to be very busy) you could increase the smtp connections available, but what you're seeing is usually indicative of mis-use of the SMTP server in some manner.

How do you increase the number of SMTP connections available??

[chirpy]

The default is 100, you can up that by setting the following in the first textbox of the exim configuration editor:

smtp_accept_max = 150