The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

too many queue processes

Discussion in 'E-mail Discussions' started by cisnet, Oct 30, 2007.

  1. cisnet

    cisnet Member

    Joined:
    Nov 30, 2004
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    1
    Starting today I seem to be spawning dozens of queue processes. Not sure why. they just seem to pop up and the list keeps growing. This starts right at restarting exim also.

    I currently have a couple dozen of these going and just restarted Exim a couple of minutes ago. Seems that every minute it starts lots of queues until it stops delivering incoming mail .


    mailnull 24085 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24094 0.0 0.4 31548 4100 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24117 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24152 0.0 0.3 31536 3428 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24157 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24220 0.0 0.4 31548 4100 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24246 0.0 0.3 31540 4096 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24249 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24251 0.0 0.3 31540 4096 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24286 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24293 0.0 0.4 31540 4100 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24463 0.0 0.3 31536 3424 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24477 0.0 0.3 31536 3424 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24584 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24585 0.0 0.3 31536 3428 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24598 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24603 0.0 0.3 31536 3424 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24640 0.0 0.3 31536 3428 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24641 0.0 0.3 31536 3424 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24770 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24831 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24860 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
     
    #1 cisnet, Oct 30, 2007
    Last edited: Oct 30, 2007
  2. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Could be a lot of mail outbound (such as some script being used to generate spam) - Could be a lot of mail inbound (some joe job on somebody's domain or something like that).

    You probably should look at /var/log/exim_mainlog and /var/log/exim_rejectlog and see what's going on while all of the processes are running. I'm sure that would paint more of a picture for you and us.

    Also - check Mail Queue Manager in WHM and see if if it's showing an insane amount of queued mail.

    Mike


     
  3. cisnet

    cisnet Member

    Joined:
    Nov 30, 2004
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    1
    hmmm

    Inbound has a message number connected to it. Is there some way to determine where a script would be starting the process from?
     
  4. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    As I said, /var/log/exim_mainlog (or /var/log/exim_rejectlog as well) should be able to assist you greatly. The log files are there for a reason.

    If they do not give you enough ifnormation, you can turn on more verbose logging in exim to see exactly what script is generating the mail, if it indeed is a script on the server generating.

    Mike
     
  5. cisnet

    cisnet Member

    Joined:
    Nov 30, 2004
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    1
    massive dictionary attack

    I get thousands of emails a day on this server, so it took a while. One massive dictionary attack against one domain I guess. groan... Each 'sender' is a new forged domain from the looks of it.

    Or backscatter?

    2007-10-30 21:39:13 H=(mail.netvista.net) [208.96.29.235] F=<> temporarily rejected RCPT <Xeon-Domic@xxxxxx.com>: error in redirect data: missing or malformed local part (expected word or "<") in ":fail"

    All different source IP's. I turned traceback on in the router, so the ip's are probably valid. All different user names. sigh...
     
    #5 cisnet, Oct 30, 2007
    Last edited: Oct 30, 2007
  6. nyjimbo

    nyjimbo Well-Known Member

    Joined:
    Jan 25, 2003
    Messages:
    1,125
    Likes Received:
    0
    Trophy Points:
    36
    Location:
    New York
    That is usually a malformed valiases file. Go to /etc/valiases (thats for freebsd, might be the same for linux) and look for the domain name you commented out above. Look for a fail statement (probably at the bottom), it should be

    *: :fail:

    In the "old days" a user could manually enter their fail statement and BOY did they screw them up ALOT.

    If its a email address and a fail like

    bob@whatever.com: :fail:
    check to see if its missing anything like the above format.
     
    #6 nyjimbo, Oct 30, 2007
    Last edited: Oct 30, 2007
  7. shahaneh_as

    shahaneh_as Registered

    Joined:
    Mar 18, 2010
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    cPanel mail problem

    I have a problem in my cPanel ... when I send an email it's show that it was send , when I try to send an email on cpanel mail account It's show that mail was send but nowhere I get the mail..
    when I try to restart my mail server from cPanel interface I get this error

    Waiting for exim to restart..............finished.

    exim (/usr/sbin/exim -bd -q60m) running as mailnull with PID 22222
    exim (/usr/sbin/exim -bd -q60m) running as mailnull with PID 22264

    exim has failed, please contact the sysadmin.
    :confused::confused::confused:

    please help me solve this problem:(
     
Loading...

Share This Page