set up rule if server goes to 75 to stop automatically exim?

[audrey]

Hi

My servers are getting hammered by exim attacks.

Here is what happens:
Thousands of people are connecting to exim all at once-
but each IP shows up only once in netstat and I can't all the IPs

I was wondering if there is a way to set up
some kind of server rule in cpanel or in CSF
so that when the CPU on a server goes up to goes to 75
the server automatically shuts down exim?

Any other ideas to solve this issue?

Thanks
Audrey

 

[iserversupport]

You can set the limit by tweaking the variable deliver_queue_load_max

I think you should find the root case than setting the load limit for exim

 

[audrey]

Thanks a ton for your suggestion.
It sounds like a great idea
I will try it now.

Take Care
Audrey

 

[audrey]

Hi

for this setting
deliver_queue_load_max
it was set to 36
I changed it to 20

for this setting
queue_only_load
was set to 72
I set to 30

The reason that I want exim to stop automatically is
to immediately drop the server load
before the attack takes down the server.
(this works great if I stop exim manually-
but-I can't watch the server loads on the servers 24/7)

I am happy with changing the above settings-
but-
I am concerned that it is not going to solve the high load issue.
Any ideas on this?

Thanks again
Audrey

 

[cPanelMichael]

Hello

The following thread might be helpful to you:

Sustained Exim Attack

Thank you.

 

[audrey]

HI

Thanks for the link.

Thanks for your help

Take Care
Audrey