Sendmail problems on RHEL5 (and solution)

[Randal, Phil]

On a standard CentOS 5 install here we get:

[root at mx0 ~]# cat /proc/sys/net/ipv4/tcp_wmem
4096    16384   4194304
[root at mx0 ~]# cat /proc/sys/net/ipv4/tcp_rmem
4096    87380   4194304

Cheers,

Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf 
> Of Denis Beauchemin
> Sent: 10 September 2007 16:57
> To: MailScanner
> Subject: OT: Sendmail problems on RHEL5 (and solution)
> 
> Hello all,
> 
> Ever since I switched to my new RHEL5 MS servers I was noticing many 
> errors like these:
> Sep  7 00:10:36 132.210.244.13 sendmail[6929]: 
> l873tB1s006929: collect: 
> premature EOM: unexpected close
> Sep  7 00:10:36 132.210.244.13 sendmail[6929]: 
> l873tB1s006929: collect: 
> unexpected close on connection from pobox.sfu.ca, 
> sender=<someone at sfu.ca>
> 
> I could get thousands of these in a day and they resulted in delivery 
> delays that were starting to annoy seriously my users because 
> they were 
> coming from legitimate servers.  I was also annoyed because the boxes 
> were running with more and more sendmail processes.
> 
> We finally tracked it down to a faulty TCP/IP default setup 
> on RHEL5!  
> To correct the problem I had to:
> sysctl -w net.ipv4.tcp_wmem="4096 16384 131072"
> sysctl -w net.ipv4.tcp_rmem="4096 87380 174760"
> 
> and modify /etc/sysctl.conf :
> net.ipv4.tcp_wmem="4096 16384 131072"
> net.ipv4.tcp_rmem="4096 87380 174760"
> 
> For some unknown reason the TCP/IP stack was telling some 
> remote hosts 
> to use a really small window size and this resulted in some equipment 
> down the line breaking the connection.  It happened more 
> often with big 
> emails (the ones with attachments).
> 
> I don't know if this bug is also present on CentOS5, but it 
> might be...
> 
> The following commands might help you find out if you have 
> the problem 
> (quick hack):
> grep "unexpected close on connection" /var/log/maillog | perl -ne '
>   next unless /collect: unexpected close on connection from ([^,]+),/;
>   $f{$1}++;
>   END{
>     foreach $i (sort keys %f){
>       printf "%25s : %d\n", $i, $f{$i};
>     }
>   }' | sort -k3n | tail
> 
> If you see some servers with hundreds of errors, you may have 
> the problem...
> 
> Denis
> 
> -- 
>    _
>   °v°   Denis Beauchemin, analyste
>  /(_)\  Université de Sherbrooke, S.T.I.
>   ^ ^   T: 819.821.8000x62252 F: 819.821.8045
> 
> 
>