Nick
I had this happen once, fire up the Imail log analyzer in your imail folder,
run it on your sysmmdd.txt log for the day this issue came up. Check everything
and run it. Look for way out of bounds senders.
this could be anything, but check smtp senders, but could be anything. With
luck you should see some user with high outgoing numbers, pull the user up and
disable the account, or change the password. If they belong to you I'd make
sure it was a stolen user id and pw and not an infected user computer.
Good luck
John
-----Original Message-----
From: "Nico Gazzano" <[EMAIL PROTECTED]>
Sent 9/6/2007 11:01:46 AM
To: "Imail_Forum" <[email protected]>
Subject: [IMail Forum] Imail queue keeps flooding!!I'm having a serious problem
with my Imail server. About 3 times in the past two weeks I have had to go in
and stop all imail services and delete GSE, SMD, and VAC files in the spool
directory because something is flooding the queue, roughly 5k-6k messages in a
matter of minutes.
To bandage it up I run my sniffer and block the culprit IP on the perimeter.
More of a deterrent than a solid fix, but I can't find the cause of the problem
and I was wondering if someone can point me in the right direction.
I'm also looking into using and ISCSI SAN to hold my domains/users/spool
directories, has anyone implemented this and does it work well?
iMail setup is as follows:
Installed on VMware Host
using local user authentication.
using local mailbox folders.
relaying only allowed for specified IP addresses.
no AV on server
external barracuda spam filter
Not using virtual domains
-Nico
