Re: [Declude.JunkMail] multiple simultaneous problems
1) Are they just q files or d files or both? 2) Tripple check the DNS server(s) being used for problems. 3) Do you have a lot of large mailboxes? Has the amount of email flowing in increased? 4) Review information on the Sniffer list about updating to the new service model. Also, what version of Imail, what version of Declude?John T eServices For You -Original Message- From: David Dodell [EMAIL PROTECTED] Sent 2/28/2008 9:10:02 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] multiple simultaneous problemsAfter running Declude / Imail smoothly for years ... the last few days have been the pits (1) Multiple files showing up in the /spool/proc directory and not leaving (2) Declude is failing to make connections on RBL tests about 10 to 20% of the time. Running in debug mode will show one message running against multiple DBL tests, and then the message will show the first 5 DBL tests running, and the rest fail with no connection (3) IMAP4d32.exe services are running 99% of the cpu time ... (4) Multiple instances of the sniffer exe program Any thoughts on where to start ... I've rebooted, stopped services, restarted services ... works fine for about 8 hrs then starts up all over again David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] multiple simultaneous problems
All of that is good advice -- but one extra thing drew my attention -- IMAP running 99% CPU -- in my mind that points to possible file system issues - What shape your file system is in: Is it badly fragmented? Are any of your drives performing badly? Also - has someone suddenly changed what they are doing in IMAP that could cause heavy IO loads? One system I helped on recently was slowly sucking itself into it's own private circle of hell along with it's admin. I followed the performance trail to the IO and found that a couple of large log files were very badly fragmented -- I moved those files to a new location and everything perked up right away. * File moves often evaporate fragmentation. * Files that grow slowly over a long period on a mail server on NTFS tend to get badly fragmented. My $0.02. _M On Friday, February 29, 2008, 3:38:53 AM, John wrote: 1) Are they just q files or d files or both? 2) Tripple check the DNS server(s) being used for problems. 3) Do you have a lot of large mailboxes? Has the amount of email flowing in increased? 4) Review information on the Sniffer list about updating to the new service model. Also, what version of Imail, what version of Declude? John T eServices For You -Original Message- From: "David Dodell" [EMAIL PROTECTED] Sent 2/28/2008 9:10:02 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] multiple simultaneous problems After running Declude / Imail smoothly for years ... the last few days have been the pits (1) Multiple files showing up in the /spool/proc directory and not leaving (2) Declude is failing to make connections on RBL tests about 10 to 20% of the time. Running in debug mode will show one message running against multiple DBL tests, and then the message will show the first 5 DBL tests running, and the rest fail with "no connection" (3) IMAP4d32.exe services are running 99% of the cpu time ... (4) Multiple instances of the sniffer exe program Any thoughts on where to start ... I've rebooted, stopped services, restarted services ... works fine for about 8 hrs then starts up all over again David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archivehttp://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] multiple simultaneous problems
On Feb 29, 2008, at 1:38 AM, John T wrote: 1) Are they just q files or d files or both? Both, 13000 files this morning from overnight total .2) Tripple check the DNS server(s) being used for problems. I have, plus we tried an external DNS and same issue. 3) Do you have a lot of large mailboxes? Has the amount of email flowing in increased? Nope ... maybe a total of 100 active mailboxes ... 4) Review information on the Sniffer list about updating to the new service model. I should be on the latest version of Sniffer ... just renewed my contract ... haven't made any changes to the configuration in months. Also, what version of Imail, what version of Declude? 9.23 imail ... was running the latest release of Declude ... declude moved me to the latest beta yesterday. Woke up and checked ... IMAP4d32 is running at 90+ % of the CPU still. There are multiple instances of the bcl*.exe (my sniffer) running ... probably 30 or 40 copies open in the processes. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] multiple simultaneous problems
David, Comment's inline (2) Declude is failing to make connections on RBL tests about 10 to 20% of the time. Running in debug mode will show one message running against multiple DBL tests, and then the message will show the first 5 DBL tests running, and the rest fail with no connection Which RBL's are timing out? Is your DNS server having problems? Is your DNS server local to the mail server or is it located somewhere else? (3) IMAP4d32.exe services are running 99% of the cpu time ... This will essentially starve out Declude and anything else. I have seen several folks have this issue on the Imail list. What version of Imail are you using? (4) Multiple instances of the sniffer exe program This is normal - on my server with a decent volume its not uncommon to see 20-30 sniffer's running at the same time. It all depends on how many threads you are running. Any thoughts on where to start ... I've rebooted, stopped services, restarted services ... works fine for about 8 hrs then starts up all over again I would start with the IMAP4D issue. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] multiple simultaneous problems
On Friday, February 29, 2008, 8:14:41 AM, David wrote: snip/ 4) Review information on the Sniffer list about updating to the new service model. DD I should be on the latest version of Sniffer ... just renewed my DD contract ... haven't made any changes to the configuration in months. I've checked and I don't see telemetry from your SNF installation... It's a good bet that you are running version 2.5 -- which is ok, but the latest version is 2-9b1.5 - a late beta. The beta is production ready -- it is only still beta because we are adding a few features before calling it a release candidate -and shortly after that - version 3. The newest version is faster, more efficient, and more accurate. Based on your description of the problem, moving to the newest version of SNF will probably not solve your problem - but it may reduce the system load enough to make a dent. For scientific reasons (not changing too many things at once) you may want to resolve your IMAP issue first, but that done-- upgrading to the latest version of SNF is highly recommended. One key reason that it might help in this case is that the 2.x version of SNF uses the NTFS file system to track scan jobs and the new version uses local TCP connections. With the older version, when under extreme load conditions, the file system can become so slow that SNF can't process messages quickly-- SNF scan jobs get killed off before they are completed, and the message job files build up making the problem worse. This can be... trouble ;-) The new version does not use the file system at all except to access the message files so it is immune to the overload problem described above. Hope this helps, _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] multiple simultaneous problems
-Original Message- From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] Which RBL's are timing out? Is your DNS server having problems? Is your DNS server local to the mail server or is it located somewhere else? It is totally random ... sometimes none of them for several messages, other times, the first several work, and the rest fail ... doesn't seem to be any pattern (3) IMAP4d32.exe services are running 99% of the cpu time ... This will essentially starve out Declude and anything else. I have seen several folks have this issue on the Imail list. What version of Imail are you using? 9.23 since it was released ... been running it for a while. Any thoughts on where to start ... I've rebooted, stopped services, restarted services ... works fine for about 8 hrs then starts up all over again I would start with the IMAP4D issue. Darrell, I agree ... just wish I knew what was affecting it. Another response suggested the file system ... and I noticed the comment from the Sniffer people about NTFS. We have had some bad sectors on our hard drive starting about a few weeks ago ... Ran chkdsk etc and that seemed to have caught them, ran a defrag session today ... I order today a new Barracuda ES2 drive for the server, which will arrive Monday and I'll attempt to clone. Linda @ Declude suggested I might be having a bad network card go bad, which she thinks is attributing to the failed RBL issues, but I don't think that would affect the IMAP usage. Short of installing a new network card / drive ... any other thoughts what to try? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] multiple simultaneous problems
On Friday, February 29, 2008, 11:26:58 PM, David wrote: snip/ Short of installing a new network card / drive ... any other thoughts what to try It's a long shot - but if it were my server I would try it: Shut down IMAP. Temporarily shut down SMTP so that new mail doesn't go in to those boxes. Remove the mailbox files from all of the users who use IMAP. Restart IMAP. See if it acts normal. If it does, proceed. If not - this is fubar - try something else. Put back one mailbox file at a time and observe IMAPs behavior. As long as IMAP seems normal continue. At some point - presumably - one of the mailbox files will cause IMAP to go crazy -- if we're lucky. When you find that one -- move it off again to avoid the problem (probably restart IMAP to do it). Replace the other IMAP users' mailbox files. If this procedure works as expected we may discover a corrupted mailbox file that is causing a problem with IMAP. If we're that lucky then we will be able to decide what to do with that mailbox file later and in the mean time go back to normal. Let me know if this works (hope it does). If it doesn't work I hope we learn something new at least. Best, _M ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] multiple simultaneous problems
It might help to open task manager and reduce the service priority for the time being to give you a little more breathing room until you get the problem sorted out. Brian David Dodell wrote: -Original Message- From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] Which RBL's are timing out? Is your DNS server having problems? Is your DNS server local to the mail server or is it located somewhere else? It is totally random ... sometimes none of them for several messages, other times, the first several work, and the rest fail ... doesn't seem to be any pattern (3) IMAP4d32.exe services are running 99% of the cpu time ... This will essentially starve out Declude and anything else. I have seen several folks have this issue on the Imail list. What version of Imail are you using? 9.23 since it was released ... been running it for a while. Any thoughts on where to start ... I've rebooted, stopped services, restarted services ... works fine for about 8 hrs then starts up all over again I would start with the IMAP4D issue. Darrell, I agree ... just wish I knew what was affecting it. Another response suggested the file system ... and I noticed the comment from the Sniffer people about NTFS. We have had some bad sectors on our hard drive starting about a few weeks ago ... Ran chkdsk etc and that seemed to have caught them, ran a defrag session today ... I order today a new Barracuda ES2 drive for the server, which will arrive Monday and I'll attempt to clone. Linda @ Declude suggested I might be having a bad network card go bad, which she thinks is attributing to the failed RBL issues, but I don't think that would affect the IMAP usage. Short of installing a new network card / drive ... any other thoughts what to try? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
