The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Exim and e-mail attachments

Discussion in 'E-mail Discussions' started by Oriso, Feb 22, 2005.

  1. Oriso

    Oriso Member

    Joined:
    Dec 10, 2003
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    1
    Hi,

    We've been having loads of problems receiving e-mails with attachments since the upgrade of Exim around 9.9.8. The logs are full of these messages each time an attachment is received. This is beginning to be a big problem for our customers. As anyone encountered this ? We tried upping the smtp_receive_timeout in the configuration file, but no luck as of yet. Server is otherwise fine, large files coming in through FTP don't have any such issues.

    2005-02-22 05:37:55 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
    2005-02-22 06:14:33 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
    2005-02-22 06:46:29 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
    2005-02-22 07:07:44 SMTP connection from (xx.xx.ca) [24.xx.xx.xx] lost while reading message data
     
  2. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Never seen such problems. Have you tried resetting your exim configuration to defaults incase something has been played with that shouldn't have:

    /scripts/reseteximtodefaults
     
  3. lloyd_tennison

    lloyd_tennison Well-Known Member

    Joined:
    Mar 12, 2004
    Messages:
    698
    Likes Received:
    1
    Trophy Points:
    18
    What size are the attachments? Are they over your allowed size?
     
  4. Oriso

    Oriso Member

    Joined:
    Dec 10, 2003
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    1
    We didn't reset exim, but we used another box with Postfix and configured it as MX for one of our hosted domains. We then used the transport functionality to redirect e-mails back to the cPanel server. Same problem. So I guess we can rule out cPanel on this one.

    Grepping through exim_mainlog I found out that for over 1000 dropped connections, 40% were from the same provider. After discussing with users, it seems most "lost" e-mail where from that provider. So I called them up (big ISP too, just trying to reach someone who cares was hard) and they've had these kinds of problems with their newer spam/anti-virus software software so they'll look into it.

    Thanks anyway guys.
     
  5. spaceman

    spaceman Well-Known Member

    Joined:
    Mar 25, 2002
    Messages:
    481
    Likes Received:
    0
    Trophy Points:
    16
    Any resolution here? We've just discovered the same problem. Our exim_mainlog is full of lines like the above.

    We know that many (if not all) of the associated attachments are relatively tiny (e.g. less than 1 Mb).

    Help! :) V. concerned to nail this problem quickly.
     
  6. lloyd_tennison

    lloyd_tennison Well-Known Member

    Joined:
    Mar 12, 2004
    Messages:
    698
    Likes Received:
    1
    Trophy Points:
    18
    Is that server (not yours) a slow server? Could Exim be timing out? DO you have any more info as to the message, attachement type, etc.? Maybe should enable extensive logging for a few days to track it down.

    Start with:


    log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_
    interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery
    +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_p
    eerdn

    and there may be more that may be more specific to your needs.

    Or how about capturing the exim output with a verbose (-v) command. Will create huge logfiles - but may be only way.

    Also, what anti-SPAM measures are you attempting? Maybe the antivirus or Spam Assassin. going crazy.
     
  7. spaceman

    spaceman Well-Known Member

    Joined:
    Mar 25, 2002
    Messages:
    481
    Likes Received:
    0
    Trophy Points:
    16
    Thanks for all that.

    Q.1 That's all to go in /etc/exim.conf, correct?

    Q.2 Would I be correct in saying that, just like httpd.conf, I don't have to stop exim before editing exim.conf, but I do have to stop and restart exim to apply the changes. Correct?

    Thank again. I'll get there!

    (p.s. our main techie guy is on hols right now, so I'm kind of holding the fort until he gets back)
     
  8. spaceman

    spaceman Well-Known Member

    Joined:
    Mar 25, 2002
    Messages:
    481
    Likes Received:
    0
    Trophy Points:
    16
    Also, yes, we're using the Clam AV, Mailscanner combo on our machine. So I'd say it's quite likely a screwy config in there is causing the problem. We'll see...
     
  9. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    A few things to try:

    /scripts/updatenow
    /scripts/eximup
    /scripts/buildeximconf
    /scripts/mailscannerupdate
    service exim restart


    If you're using my MailScanner script:

    /usr/mscpanel/mscheck.pl
     
  10. spaceman

    spaceman Well-Known Member

    Joined:
    Mar 25, 2002
    Messages:
    481
    Likes Received:
    0
    Trophy Points:
    16
    Hi Jonathon. Wondered if/when you'd pop up (in the nicest possible way x 10) :)

    At the risk of sounding like a complete girls blouse (for want of a better phrase), can you give a brief description of what each of those commands do, or point me to another post or other url that does. I'm keen to learn what I'm doing before I do them.

    Is it fair to assume - and the very fact that you'd mention these scripts implies it is - that running all of these scripts is extraordinarily unlike to break anything?

    Yup - it's official - I'm a girls blouse (no disrespect intended to girls or blouses).

    p.s. I've started the extra logging in exim.conf after cross checking lloyd_tennison's advice here: http://forums.cpanel.net/showthread.php?t=31034
     
  11. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Hi,

    No problem ;) None of the scripts are likely to break anything, quite the opposite:

    /scripts/updatenow - this makes sure that you have the latest /scripts/* files for your release tree

    /scripts/eximup - this makes sure that you are running the latest version of exim for your release tree

    /scripts/buildeximconf - this rebuilds /etc/exim.conf (and /etc/exim_outgoing.conf if you have MS installed) from the default exim build plus any changes made in the Exim Configuration Editor

    /scripts/mailscannerupdate - this ensures that the MS modifications required for exim are included in /etc/eximcofn and /etc/exim_outgoing.conf

    service exim restart - this restarts exim ;)

    /usr/mscpanel/mscheck.pl - this ensures that all the split spool directories have been created and restarts MailScanner

    You might also want to run:

    /scripts/mailperm - rebuilds /etc/localdomains and checks file permissions and ownerships on user mail files and exim system files.
     
  12. spaceman

    spaceman Well-Known Member

    Joined:
    Mar 25, 2002
    Messages:
    481
    Likes Received:
    0
    Trophy Points:
    16
    Nice one.

    Starting at the top of your list, working down. /scripts/eximup is doing some heavy duty sh1t by the looks of things...

    In summary, I guess what you're saying is "Don't try to debug what's going on until you've updated to all relevant software to latest versions. Then check to see if problems persist.". Makes sense to me. :)
     
  13. spaceman

    spaceman Well-Known Member

    Joined:
    Mar 25, 2002
    Messages:
    481
    Likes Received:
    0
    Trophy Points:
    16
    I've done all that's been suggested so far (thanks!), but it appears that we are still seeing this error, eg:

    2005-08-11 18:47:58 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:61641 I=[216.7.176.122]:25 lost while reading message data

    Despite adding all the extra reporting into exim.conf, no additional info (over and above what you see above) is available.

    I've also checked (grepped) /var/spool/exim_incoming/msglog and /var/spool/MailScanner/quarantine but can't see any further evidence or reporting of what's behind this sort of error.

    Starting to run out of options here...

    Any takers?
     
  14. spaceman

    spaceman Well-Known Member

    Joined:
    Mar 25, 2002
    Messages:
    481
    Likes Received:
    0
    Trophy Points:
    16
    Latest sample data. Don't think I'm giving away any critical security info by listing this info 'as is' - if someone thinks I am, let me know:

    2005-08-11 17:15:14 SMTP connection from (queue04-winn.ispmail.ntl.com) [81.103.221.58] lost while reading message data
    2005-08-11 17:28:57 SMTP connection from (soundfinance.com.au) [220.235.40.27] lost while reading message data
    2005-08-11 17:54:42 SMTP connection from (mailbo.vtcif.telstra.com.au) [202.12.144.19] lost while reading message data
    2005-08-11 17:57:59 SMTP connection from (malcolmsargent.org.au) [203.129.145.102] lost while reading message data (header)
    2005-08-11 18:24:14 SMTP connection from (mailbo.vtcif.telstra.com.au) [202.12.144.19]:36507 I=[216.7.176.116]:25 lost while reading message data
    2005-08-11 18:36:02 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:56628 I=[216.7.176.122]:25 lost while reading message data
    2005-08-11 18:46:21 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:56643 I=[216.7.176.122]:25 lost while reading message data
    2005-08-11 18:47:58 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:61641 I=[216.7.176.122]:25 lost while reading message data
    2005-08-11 19:47:46 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:38000 I=[216.7.176.122]:25 lost while reading message data
    2005-08-11 19:52:55 SMTP connection from (mailbo.vtcif.telstra.com.au) [202.12.144.19]:43519 I=[216.7.176.116]:25 lost while reading message data
    2005-08-11 20:36:34 SMTP connection from (216.7.176.116) [212.30.78.95]:1063 I=[216.7.176.116]:25 lost while reading message data (header)
    2005-08-11 20:36:58 SMTP connection from (dmz1util1.bankwest.com.au) [203.19.158.21]:41723 I=[216.7.176.122]:25 lost while reading message data
    2005-08-11 20:37:56 SMTP connection from (bland-media.com) [200.75.29.37]:4395 I=[216.7.176.116]:25 lost while reading message data (header)
     
  15. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    To rule out any configuration changes that may have caused the problem, I'd suggest that you try the following that will reset your exim configuration and remove the use of MailScanner completely - this is reversible:

    cd /etc
    rm -fv exim_outgoing.conf
    # stops exim from regenerating the files for MS integration
    mv exim.conf.local exim.conf.local.old # disables any modifications
    /scripts/buildeximconf # generates a clean /etc/exim.conf
    service exim restart

    Now see if it's OK. If it is, then it#s a configuration problem somewhere. If it is still happening, you could then log a ticket with cPanel as you'll now have a supported configuration.


    To get MailScanner back in with your config changes:

    cd /etc
    mv exim.conf.local.old exim.conf.local
    touch exim_outgoing.conf
    /scripts/buildeximconf
    /scripts/mailscannerupdate
    service exim restart
     
  16. spaceman

    spaceman Well-Known Member

    Joined:
    Mar 25, 2002
    Messages:
    481
    Likes Received:
    0
    Trophy Points:
    16
    Phew. Got to the bottom of this at least. Had nothing to do with exim or mailscanner or related. It was a physical problem with a network port. This from the data center:

    'I bet this problem keeps happening after the server is rebooted, thereby restarting the autonegotiation, and causing a duplex mismatch. I would like to suggest we run the following command on bootup:

    mii-tool --force=10baseT-FD eth0

    This will force the interface to 10baseT-FD, which appears to be the ideal setting for things to work flawlessly. So if the server is rebooted again in the future the duplex will be set correctly."

    That info may help someone else. One day... :)
     
Loading...

Share This Page