Hi. I got a red hat installation running named. The problem started about 3 and a half months ago. It was working fine since forever. Now, it's all working slow and that causes, i think, named to stop resolving. I have cleared logs in /var/log to see if it's a disk full problem, so far, i don't think thats the MAIN problem. I also ran top, and to my surprise, there's a process called 'sendmail' that appears like 20 times in the same window when running top. I researched about sendmail, but the info is just not near enough for me to troubleshoot.

So, if any of you would be having this lagging and freezing problem in your linux, what would you do to solve it? Or perhaps where would you start looking for info and logs so crawl up to the source of the problem?

I have read the following files in /var/log:
messages
maillog

I usually get an error that some rxrrset prerequisite is not there or something like that, logged in the messages file. Any help would be very much appreciated.

The mutliple sendmails in top should concern you if this is a DNS server only. You can run sendmail as a daemon to process mail but if so you really need to block connections to it (port 25) from outside the server. Anyone that can do reach your DNS server can do a port scan on it and if they find port 25 answering they can use your sendmail to relay spam which is a good way of getting your IP blacklisted.

You can use the chkconfig command to tell it not to automatically start the sendmail daemon.

Also you really should use iptables to block all the ports (on your external IP at least) so that the only connections made are for DNS lookups.

Well, named is a DNS service, isn't it? In our case, it is used for internal purposes, and it redirects requests to outside DNSs when it cannot resolve for itself. Now, i am pretty sure there is nothing that requires any mail activity in this server, we do have other servers that are in charge of this mail stuff. Can i just stop the freaking thing? And if so, how do you stop it?

# service sendmail stop
# chkconfig --level 12345 sendmail off
You also need to make sure you are blocking all ports except DNS with iptables.
Sendmail can also be run from local clinets that are sending outgoing mail. It could also be that these processes are hanging and that's what you are seeing. Best to uninstall sendmail if you are not using it.

# rpm -e sendmail

That sounds like a good idea, i will probably uninstall sendmail. I don't think it's being used. BTW, i've googled sendmail and i don't find that much literature about it. Is it like not used at all or is it part of some bigger packaged, like the named service that comes with BIND, for instance.

If these questions look weird, please remember i am kinda still learning how to go around using linux.

Thanks for all the help, and please put any info you come up with, the more the better.

The named service has lots of documentation and how-to's.
The main web site is http://www.isc.org/
Also in the cases where I need a mail server I replace sendmail with exim . People also use postfix. I honestly don't know why sendmail is still being used... I'm not flaming it.

Hey guys, interesting things have happened since i shutdown sendmail ()
# service sendmail stop
# chkconfig --level 12345 sendmail off

After performing those steps, the server inmediately started working well again. I also cleared the following log files: messages & maillog. The only thing that i don't get is this: maillog is still getting filled by messages regarding sendmail. I would think that the second step there would stop the service from running, but somehow it is still being invoked by another. At least that's what it seems. So, what i would like to do next is to figure out why is it still running as some kind of background job. I guess it's running as a bg job, taking into account that sendmail does not appear in the list when typing the 'top' command.

The mta, be it sendmail or other, is used to send outgoing mail as well. It is also invoked to deliver local mail to the root user, most often from the daily cron called logwatch.

Your daemon is probably not running, however you do have cron jobs that run at night that send mail to the root user.

MTA? What's this? I'll be sure to look that up. I've done my studying, jejeje. Mail Transport Agent. Thanks for the info.

And by the way, how does one check all this mail info that the system sends to root? I can check it up, read it to see if there are any clues, and probably also clear it every now and then to save disk space? These are all functions that i don't know if i should be doing on a regular basis, so are they?

In your /etc/aliases, change the line
Then "randyd" gets roots mail and can read it daily.
Otherwise you have to log in as root and run mutt, elm, whatever to read root's mail.

I don't really want to send this mail to some other user. I might as well check it as root with those apps you mentioned. I think i can clear it at least. Last question here: is all this mail sent to root about things going on in the system the reason why maillog is being filled up? If you tell me this is so, then ok; but it's way to much information, i don't think i wanna read all that stuff, it's just too much. Jejejeje.

BTW, i just have to say that every one of you guys severly rock. This forum rules!!! Thanks for all the help dudes. I hope one day i can help others and perhaps all you as you have done for me several times now.

Generally, its best to read the mail as a normal user and not root.
The system admin should read root's mail under their own normal user account.
This mail is normally created by cron jobs. Whenever a cron job prints something to stdout, it is sent to the root user as a mail message.
You can experiment with this. Try creating a file in /etc/cron.daily/mytest.cron that consists of the following.
$ chown root:root /etc/cron.daily/mytest.cron
$ chmod 755 /etc/cron.daily/mytest.cron

So far, i've been clearing some logs in /var/log. I managed to clear up almost 5 Gb of disk space by just erasing almost every log i have over there. Pretty good huh? Either way, most of the information that was stored there in the logs i couldn't understand, so i figured hey, why bother, just erase it now, it'll be filled up again soon, so you'll have more information to do research with. So i guess my server could be at least a bit stable now. I am crossing my fingers of course, and i will continue to see how this maillog thing is still getting jammed up with log info.