First, I would like to thank Odhiambo and Jan for their responses. They were helpful.
Second, in case someone else searches for an answer to this problem, I would like to carefully describe the steps for its solution. Here is how the problem was overcome: The normal, straighforward way to delete a bunch of queued emails would be one of these forms. To delete all frozen emails: exipick -iz | xargs exim -Mrm To delete all emails in the queue from a specific user: exipick -i '\$sender_address eq [email protected]' | xargs exim -Mrm Since my server only has the older "exiqgrep" command, the straightforward command for me would have been: exiqgrep -i -f [email protected] | xargs exim -Mrm In all of the above cases, the "-i" argument causes exipick/exiqgrep to build a list of the relevant message ids They would be sent through a unix pipe to the exim delete command "exim -Mrm" with xargs managing small groups of ids at a time. Once I had the proper command form the first error encountered was that there were too many message ids so that the linux system could not build a pipe The way to get around that problem was to write the list of relevant ids into a file. Of course if you are in the process of examining the exim spool folder you might try to write to a file on the same disk partition as the spool folder and hit the error message that the disk is full and you cannot write to it. So you must find a disk partition with space. I successfully executed the command exiqgrep -i -f [email protected] > /root/eximids Now that you have a file with a list of ids to be deleted, the straightforward command to do that would be xargs exim -Mrm < /root/eximids But before doing that if you build a smaller list to test that command tail -20l /root/eximids > /root/eximids-sample and then try the deletion xargs exim -Mrm < /root/eximids-sample you will see the process and the next error messages indicating that the attempt by exim to write the log entry failed because the disk is full. exim cannot execute the delete command without disk space to log the activity. So you cannot proceed until you find some files (directories) on that disk partition that could be moved to another disk partition. Remember that once there is space available on the disk partition, the frozen exim process will begin to send the queued emails again. So you must be prepared to quickly give the delete command xargs exim -Mrm < /root/eximids as soon as disk space is available on the partition holding the exim spool (/var/spool/exim) It would have been nice to prevent exim from beginning to send those frozen emails, because they were all spam, but I don't know how to do that. The good news is that sending emails is a much slower process than deleting them because it requires internet travel and waiting for confirmation that an email was received. So I don't think too many spam emails actually were sent before they were deleted. A final thought ... it was very beneficial that the disk partition holding the exim spool was not too large (in my case about 8 GB with 5 available for a growing queue). The hacker who hacked one of my users' accounts spooled more than 350,000 spam emails for sending. If the exim spool was on a larger disk partition, many many more spam emails would have been sent before the full disk caused exim to stop working. +++++++++++++++++ ORIGINAL MESSAGE REQUESTING HELP +++++++++++ Hello. I tried searching the docs and the mailing list, unsuccessfully. One of the accounts on a linux server I run was hacked, and the hacker has sent many and now queued several hundred thousand spam emails. The disk holding exim … /var/spool/exim … is 100 percent full. The exim and exiqgrep commands still function, but there are so many messages that any attempt to form a pipe exits in error. Since I don’t seem able to delete all messages from that sender, I am ready to delete all messages in the queue (or queues if that is the case; I am new to this). I can delete and re-create the directories /var/spool/exim/input and /var/spool/exim/msglog but I don’t know if there is anything needed inside those directories. Any suggestions by someone knowledgeable? Thank you. Steve Albin -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
