On Mon, Jul 17, 2000 at 10:43:09AM -0400, Dave Kitabjian wrote: > I recently started monitoring qmail-smtpd's activity via "tcpserver -v", > and at the moment it's burning through a steady 15-20 concurrencies, > scrolling by beyond readability. > > Meanwhile, as I "tail -f maillog" for qmail-send's activity, it sits > predominantly idle, with an occasional message to process. Now, > regardless of whether it's local or remote, it should get picked up by > qmail-send, right? > > So the question then is, if it's not receiving mail, what is qmail-smtpd > doing? Is it receiving connections from known spammers on my tcp.smtp > list, and dropping them? A quick scan of IP's doesn't jibe with that > theory; plus there's no "access denied" message shown. I'm suspicious of > all the: > > 2000-07-17 09:55:44.476546500 tcpserver: end 99787 status 256 The "status 256" is an abnormal exit code; qmail-smtpd has rejected the message and the message isn't being queued. My guess is that some dopey Windows mail server is sending you a message with bare linefeeds. Your server rejects the message (with a 4xx code) which the dopey Windows server sees as an invitation to try to deliver the message again immediately. I've seen Windows hosts try to send the same message tens of thousands of times in a day. It could be something else altogether, but I've seen the above happen many times. Chris
