How to investigate timeouts?

[Scott Silva]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jody Cleveland spake the following on 7/19/2005 2:04 PM:
>>Then, what is 'mail'?
> 
> 
> 'mail' is the Exchange server.
> 
> 
>>What kind of problem exactly?  A spamassassin timeout?  I think that
>>most of the people will have their MailScanner send scanned mail
>>directly to the destination server (the exchange in your case).
> 
> 
> Either a timeout, or hardware failure, lockup, whatever.
> 
> 
>>You should give a priority to fix your timeouts first.  Please 
>>give us more details on the timeouts so that we can help you with
> 
> that.  Once your
> 
>>timeout issues are solved, you'll be able to deliver directly from
>>destiny to your exchange.
> 
> 
> I looked at one message that ended up going through mystique, rather
> than destiny. Here's the header:
> 
> Received: from users.trulyamazingoffers.com
> (users.trulyamazingoffers.com [206.113.114.110])
> by mystique.winnefox.org (Postfix) with SMTP id 31BD137C10A
> for <_ at mail.winnefox.org>; Tue, 19 Jul 2005 15:39:25 -0500 (CDT)
> From: "Camera Phone Incentive"
> <purge-nb-763763M at users.trulyamazingoffers.com>
> To: _ at mail.winnefox.org
> Subject: Camera Phone Giveaway
> Date: Tue, 19 Jul 2005 15:00:00 -0400
> MIME-Version: 1.0
> Content-Type: text/plain; charset="iso-8859-1"
> Content-Transfer-Encoding: 8bit
> List-Unsubscribe: <mailto:leave-nb-763763M at users.trulyamazingoffers.com>
> Message-Id:
> <LYRIS-763763-740-2005.07.19-15.00.21--_#mail.winnefox.org at users.trulyam
> azingoffers.com>
> 
> There's absolutely nothing in the maillog on destiny in regards to this
> message. I look at the maillog on mystique, and found this:
> 
> Jul 19 15:39:26 mystique MailScanner[4996]: New Batch: Scanning 1
> messages, 2950 bytes 
> Jul 19 15:39:26 mystique MailScanner[4996]: MCP Checks completed at 2950
> bytes per second 
> Jul 19 15:39:26 mystique MailScanner[4996]: Spam Checks: Starting 
> Jul 19 15:39:26 mystique MailScanner[4996]: RBL checks: 31BD137C10A
> found in SBL+XBL 
> Jul 19 15:39:26 mystique MailScanner[4996]: Message 31BD137C10A from
> 206.113.114.110 (bounce-nb-763763 at users.trulyamazingoffers.com) to
> mail.winnefox.org is spam, SBL+XBL, SpamAssassin (score=6.83, required
> 5, BAYES_80 2.00, FROM_OFFERS 1.49, RCVD_IN_SBL 0.11, URIBL_JP_SURBL
> 2.46, URI_OFFERS 0.77) 
> Jul 19 15:39:26 mystique MailScanner[4996]: Spam Checks: Found 1 spam
> messages 
> Jul 19 15:39:26 mystique MailScanner[4996]: Spam Actions: message
> 31BD137C10A actions are store,deliver,striphtml 
> Jul 19 15:39:26 mystique MailScanner[4996]: Spam Checks completed at
> 2950 bytes per second 
> Jul 19 15:39:27 mystique MailScanner[4996]: Virus and Content Scanning:
> Starting 
> Jul 19 15:39:27 mystique MailScanner[4996]: Virus Scanning completed at
> 2950 bytes per second 
> Jul 19 15:39:27 mystique MailScanner[4996]: Requeue: 31BD137C10A to
> 6D99137C10B 
> Jul 19 15:39:27 mystique MailScanner[4996]: Uninfected: Delivered 1
> messages 
> Jul 19 15:39:27 mystique MailScanner[4996]: Virus Processing completed
> at 2950 bytes per second 
> Jul 19 15:39:27 mystique MailScanner[4996]: Disinfection completed at
> 2950 bytes per second 
> Jul 19 15:39:27 mystique MailScanner[4996]: Batch completed at 2950
> bytes per second (2950 / 1) 
> 
> Since there's no mention of it on destiny, is there a message to search
> for in the maillog that may indicate the message timing out, or other
> problems? Is there a different log file for errors?
> 
> - jody
> 
If it is spam, it most likely was sent directly to mystique as it is the
higher MX record.
Spammers have been hitting the higher MX for a long time, probably in
the hopes that either the secondary MX is not protected, or the transfer
from the secondary to the primary will be whitelisted or less likely to
bounce.
If you are trying to screen the exchange server, then why even have it
listed with a MX record? Have it both send and receive through either
destiny or mystique.

-- 

/-----------------------\           |~~\_____/~~\__  |
| MailScanner; The best |___________ \N1____====== )-+
| protection on the net!|                   ~~~|/~~  |
\-----------------------/                      ()

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!