|
sendmail rejecting connections
Guys,
Today I noticed that I had no new mail which is extremely odd. I went in to /var/spool/mail and sure enough, I had none, and none of the other users did either. I ran ps -ef | grep sendmail to have a look and noticed that sendmail was "rejecting connections". I restarted the server with service sendmail restart but it is still rejecting. I got this mail server running years ago, sort of understand it, but am no guru. Help, please? Thanks! Chris |
Can you have a look in /var/log/maillog and post any error messages here please? Also, what happens when you're logged into the box and type `telnet localhost 25` at a command prompt? Does it let you connect? If it did, try typing `ehlo localhost` - do you get something like the following:
Code:
250-[snip] Hello localhost [127.0.0.1], pleased to meet you |
connection refused trying to connect to 127.0.0.1.
And in maillog, I see (dating back to yesterday) rejecting connections on daemon MTA: load average 87 - 99 (there are LOTS of these messages, basically repeating itself with load averages between 87 & 99). |
I've done a bit of Googling and am now looking through my Sendmail O'Reily book. But this is all very new to me. It seems that the load is too high and because of that, Sendmail shut itself down.
Is this correct? And how do I lighten the load? Oh, and what caused the load to go so damn high? This is a small mail server running mail for 5 members of my family. We send/recieve VERY little mail. Chris |
Ok, I've continued to look all over and am basically getting more confused. It's definitely a load problem of some kind, but how to determine what is causing this remains a mystery. In addition, I'm at a loss to fix it. Any ideas, please? I think it's important to say that this server is also running apache, samba, and all the usual networking cucca...
|
You are correct - sendmail will reject connections when the server is under heavy load. Have you tried running `top`? It's real time, not historical so it needs to run when the server is actually rejecting mail.
The alternative is to check the mail log, get date/times when the rejections happened and try to match that date/time against logs for other likely candidates (cron jobs, ftp, web server, etc.). There's no guarantee that what was happening will appear in the logs, so top may be the best bet. |
top? Unknown to me. Please elaborate. Thanks for the help!
[edit]NM, Googled it. Wow, this is cool. I just realized that mysqld is running 99.9% of my CPU! What could cause this? I've also noticed, through phpMyAdmin, that there are some weird entries into tables on my databases as of late. Have I been hacked? How do I check? Killing MySQL now...[/edit] |
Holy crap! There are 88 instances of mysqld running right now!!
They all say /usr/libexec/mysqld --basedir=/u Why are there 88 instances of this running? How did this happen and how do I kill all these processes? Sorry, but I'm now assuming I've been hacked... Gotta fix, please help. Chris |
I'm assuming PHP is the only language talking to mysqld from your web pages... Unfortunately, I don't know much about PHP. The PHP security page is probably a good place to visit.
If you're running 3rd party code (a web site that uses PHP code you didn't write for example), I'd check their home pages for known vulnerabilities. Sorry it's not more specific... |
What's the output of:
Code:
ls -AlR /u | more |
It might be a good time to run
Code:
killall -s 9 mysqld |
mysql has been killed. Good lord, my server is dual proc and it was cranking on them both...
I am moderately knowledgeable about php and MySQL, but no expert. System running fine now (with MySQL off), but I will ask some MySQL experts why it is doing this now? Anyone here, perhaps? Has been running fine until yesterday apparently. Now, as soon as I login, it starts cranking out 99.9% cpu. Weird... Thank you very much for all your help. You steered me in the right direction. BTW, ls -AlR /u | more gives me: Quote:
Thanks! Chris PS. I DO have a "u" directory in /usr/share/terminfo and when I ran ls -AIR on that I got the following: Quote:
|
Sendmail is accepting connections again, but something weird is happening.
In ps -ef, I see "server publicsmtp1.com" What the hell is that? |
It looks like the process output was truncated at the 'u' instead of showing the full path to the mysqld base directory (that's just what top does when it doesn't have a lot of space.
/usr/libexec/mysqld --basedir=/u I wouldn't be worried about the stuff in /usr/share/terminfo/u, I have the same sort of stuff there. For your last post though... publicsmtp1.com doesn't resolve to anything when I look up the domain. Can you post the whole ps -ef output? I'd like to look up the PPID (parent process id) and user for that line and see which process (and who) owns it. Also, try running: Code:
grep 'publicsmtp1' /var/log/maillog*Code:
grep 'publicsmtp1' /var/log/* |
I will do this as soon as I get to work (about an hour). Can do through SSH, Thanks, you are amazingly helpful.
Chris |
| All times are GMT -5. The time now is 12:41 PM. |