Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

too many queue processes

Discussion in 'E-mail Discussion' started by cisnet, Oct 30, 2007.

  1. cisnet

    cisnet Member

    Joined:
    Nov 30, 2004
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    151
    Starting today I seem to be spawning dozens of queue processes. Not sure why. they just seem to pop up and the list keeps growing. This starts right at restarting exim also.

    I currently have a couple dozen of these going and just restarted Exim a couple of minutes ago. Seems that every minute it starts lots of queues until it stops delivering incoming mail .


    mailnull 24085 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24094 0.0 0.4 31548 4100 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24117 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24152 0.0 0.3 31536 3428 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24157 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24220 0.0 0.4 31548 4100 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24246 0.0 0.3 31540 4096 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24249 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24251 0.0 0.3 31540 4096 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24286 0.0 0.3 31536 3424 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24293 0.0 0.4 31540 4100 ? S 16:29 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24463 0.0 0.3 31536 3424 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24477 0.0 0.3 31536 3424 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24584 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24585 0.0 0.3 31536 3428 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24598 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24603 0.0 0.3 31536 3424 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24640 0.0 0.3 31536 3428 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24641 0.0 0.3 31536 3424 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24770 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24831 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
    mailnull 24860 0.0 0.3 31540 4096 ? S 16:30 0:00 /usr/sbin/exim -bd -q60m
     
    #1 cisnet, Oct 30, 2007
    Last edited: Oct 30, 2007
  2. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,338
    Likes Received:
    56
    Trophy Points:
    178
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Could be a lot of mail outbound (such as some script being used to generate spam) - Could be a lot of mail inbound (some joe job on somebody's domain or something like that).

    You probably should look at /var/log/exim_mainlog and /var/log/exim_rejectlog and see what's going on while all of the processes are running. I'm sure that would paint more of a picture for you and us.

    Also - check Mail Queue Manager in WHM and see if if it's showing an insane amount of queued mail.

    Mike


     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. cisnet

    cisnet Member

    Joined:
    Nov 30, 2004
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    151
    hmmm

    Inbound has a message number connected to it. Is there some way to determine where a script would be starting the process from?
     
  4. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,338
    Likes Received:
    56
    Trophy Points:
    178
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    As I said, /var/log/exim_mainlog (or /var/log/exim_rejectlog as well) should be able to assist you greatly. The log files are there for a reason.

    If they do not give you enough ifnormation, you can turn on more verbose logging in exim to see exactly what script is generating the mail, if it indeed is a script on the server generating.

    Mike
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. cisnet

    cisnet Member

    Joined:
    Nov 30, 2004
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    151
    massive dictionary attack

    I get thousands of emails a day on this server, so it took a while. One massive dictionary attack against one domain I guess. groan... Each 'sender' is a new forged domain from the looks of it.

    Or backscatter?

    2007-10-30 21:39:13 H=(mail.netvista.net) [208.96.29.235] F=<> temporarily rejected RCPT <Xeon-Domic@xxxxxx.com>: error in redirect data: missing or malformed local part (expected word or "<") in ":fail"

    All different source IP's. I turned traceback on in the router, so the ip's are probably valid. All different user names. sigh...
     
    #5 cisnet, Oct 30, 2007
    Last edited: Oct 30, 2007
  6. nyjimbo

    nyjimbo Well-Known Member

    Joined:
    Jan 25, 2003
    Messages:
    1,129
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    New York
    That is usually a malformed valiases file. Go to /etc/valiases (thats for freebsd, might be the same for linux) and look for the domain name you commented out above. Look for a fail statement (probably at the bottom), it should be

    *: :fail:

    In the "old days" a user could manually enter their fail statement and BOY did they screw them up ALOT.

    If its a email address and a fail like

    bob@whatever.com: :fail:
    check to see if its missing anything like the above format.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 nyjimbo, Oct 30, 2007
    Last edited: Oct 30, 2007
  7. shahaneh_as

    shahaneh_as Registered

    Joined:
    Mar 18, 2010
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    51
    cPanel mail problem

    I have a problem in my cPanel ... when I send an email it's show that it was send , when I try to send an email on cpanel mail account It's show that mail was send but nowhere I get the mail..
    when I try to restart my mail server from cPanel interface I get this error

    Waiting for exim to restart..............finished.

    exim (/usr/sbin/exim -bd -q60m) running as mailnull with PID 22222
    exim (/usr/sbin/exim -bd -q60m) running as mailnull with PID 22264

    exim has failed, please contact the sysadmin.
    :confused::confused::confused:

    please help me solve this problem:(
     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice