WOW your iowait state is WAY too high. Seems to me like you probably need to make some hard drive changes.

What is your current drive configuration? Please be as specific as possible.

If it helps, I'll describe my configuration:

I'm using three RAID arrays. Two are RAID1 and one is RAID10, with one RAID1 and the RAID10 on an LSI MegaRAID SATA 300-X8 (six drives, 160GB SATA-II). The other RAID1 is a pair of 15,000 RPM Ultra 320 SCSI drives using linux software RAID1.

The SATA RAID1 contains /
The SATA RAID10 contains /usr/local/vpopmail/domains
The SCSI RAID1 contains /tmp and some other working directories

Here are my load numbers at the random moment I went and copied them. This can fluctuate anywhere from a little more heavily used than this, to 95% idle (for reference it's a dual 2Ghz Xeon):

top - 12:49:26 up 138 days, 3:59, 1 user, load average: 2.31, 2.78, 2.30
Tasks: 238 total, 2 running, 233 sleeping, 0 stopped, 3 zombie
Cpu0: 23.6% us, 15.9% sy, 0.0% ni, 58.0% id, 2.1% wa,  0.4% hi,  0.0% si
Cpu1: 34.4% us, 10.5% sy, 0.0% ni, 54.2% id, 1.0% wa,  0.0% hi,  0.0% si
Cpu2: 25.4% us, 10.9% sy, 0.0% ni, 62.4% id, 1.4% wa,  0.0% hi,  0.0% si
Cpu3: 17.3% us, 11.9% sy, 0.0% ni, 68.4% id, 2.3% wa,  0.0% hi,  0.0% si
Mem:   2074860k total,  2043580k used,    31280k free,   254412k buffers
Swap:  4194296k total,    38020k used,  4156276k free,   887628k cached

- Nick Bright
  Network Administrator
  Terra World
  Tel 888-332-1616 x 315
  Fax 620-332-1201

João Luiz - Terra wrote:
Hi Nick.

Thank you.

When concurrent POP3 is low, the loadavg of my server is low too.
My i/o is very high. Is normal?
If any user to connect in POP3, Can he to start a attack to up my I/O?

CPU states:  cpu    user    nice  system    irq  softirq  iowait    idle
          total   10,8%    0,0%    1,0%   0,0%     0,2%   84,8%    2,9%
          cpu00   25,1%    0,0%    0,5%   0,0%     0,1%   74,0%    0,0%
          cpu01   12,1%    0,0%    0,9%   0,0%     0,3%   86,4%    0,0%
          cpu02    4,3%    0,0%    1,7%   0,0%     0,1%   87,8%    5,7%
          cpu03    1,5%    0,0%    0,7%   0,0%     0,3%   91,2%    5,9%


----- Original Message ----- From: "Nick Bright" <[EMAIL PROTECTED]>
To: <>
Sent: Monday, October 08, 2007 5:07 PM
Subject: Re: [vchkpw] qmail high performance

João Luiz - Terra wrote:
Hi Rick,

In SMTP Totals:
Max Allow   14.2 kSMTP (1422.7%) Average Allow   8345.0 SMTP (834.5%)
Current Allow   8694.0 SMTP (869.4%) Max Deny   11.4 kSMTP (1140.6%)
Average Deny   6337.0 SMTP (633.7%) Current Deny   5181.0 SMTP (518.1%)

What is Deny?

Deny is rejected SMTP sessions, usually due to an RBL rejection but this
can also be due to mailbox full or user not existing if you are using
the CHKUSER patch.

Is "Deny" high?

That doesn't strike me as overly high, over the last 24 hours I've had:

Max Allow 73.7 kSMTP (147.4%) Average Allow 36.5 kSMTP (73.0%) Current
Allow 42.3 kSMTP (84.6%)

Max Deny 54.2 kSMTP (108.4%) Average Deny 21.5 kSMTP (43.0%) Current
Deny 30.4 kSMTP (60.9%)

I wouldn't worry about the denies because they don't cause significant
load - as long as you're rejecting their connections, you don't have the
deal with the load of processing their mail.

Do you want see others logs of qmailmrtg?

Thank you

----- Original Message ----- From: "Rick Macdougall" <[EMAIL PROTECTED]>
To: <>
Sent: Sunday, October 07, 2007 10:11 AM
Subject: Re: [vchkpw] qmail high performance


João Luiz - Terra wrote:
Hi Tren,

Sorry. My english is not good :).

My server is dual xeon 2.4 with 2 Gb RAM and HD SCSI 73 Gb.
I have problems with delivery delay when my server is with many
connections POP3 and SMTP.
I use isoqlog to analyze my email traffic, but I don´t have stats of
POP3 and connections with my SMTP (RBL, no delivery, ...). Exists any
software to analyze POP3 and SMTP log?

qmailmrtg7 is a graphing tool for qmail/pop3/dnscache etc.  You can
find it at

When my server is slow, I have:
SMTP concurrent: 40 - 50
POP3 concurrent: 20 - 30
Load Average: 30 - 40

Are you running SA and Clam on the same machine ?

Also, are you running the update_tmprsadh nightly (if your not it has
to generate a new key for every encrypted connection).

I have many SMTP connections with "not existing recipient".

If that message is in the smtpd log, that's fine.

You may also want to look at decreasing your timeoutsmtpd, put 180 or
something similar in /var/qmail/control/timeoutsmtpd to change the
default of 7200 (this will stop the spam zombie who hang around just
using up a connection slot).

My server was very good. Between last monday and last friday it is
very slow.
How can I identify a possible attack?

Hope the above helps.



Esta mensagem foi verificada pelo E-mail Protegido Terra.
Scan engine: McAfee VirusScan / Atualizado em 05/10/2007 / Versão:
Proteja o seu e-mail Terra:

Esta mensagem foi verificada pelo E-mail Protegido Terra.
Scan engine: McAfee VirusScan / Atualizado em 08/10/2007 / Versão: 5.1.00/5136
Proteja o seu e-mail Terra:

Reply via email to