LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 06-19-2017, 04:05 AM   #1
tonj
Member
 
Registered: Sep 2008
Posts: 521

Rep: Reputation: 37
sendmail: Milter: from=<>, reject=451 4.3.2 Please try again later


first some info about my machine:

# cat /etc/*-release
SHMZ release 6.5 (Final)

# cat /proc/version
Linux version 2.6.32-431.el6.x86_64 (mockbuild@c6b8.bsys.dev.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-4) (GCC) ) #1 SMP Fri Nov 22 03:15:09 UTC 2013

# rpm -q sendmail
sendmail-8.14.4-8.el6.x86_64

I have puzzling behaviour in my sendmail log, the amount of data going through sendmail daily is too big and something is generating wasted server time and effort. Every hour - at exactly 10 min and 4 secs past - my maillog is showing this:
Quote:
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kZ005244: Milter (mimedefang): timeout before data read, where=eom
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kZ005244: Milter (mimedefang): to error state
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kZ005244: Milter: data, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kZ005244: to=<postmaster@freepbx.svr>, delay=00:05:01, pri=2878855, stat=Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5H553Ge026728: to=postmaster, delay=22:00:00, xdelay=00:05:01, mailer=relay, pri=4858268, relay=[127.0.0.1] [$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kb005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5G653Ge012478: to=postmaster, delay=1+21:00:00, xdelay=00:00:00, mailer=relay, pri=5718916, relay=[127.0.0.1]$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kb005244: from=<>, size=1639525, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kc005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5FA53Ge009074: to=postmaster, delay=2+17:00:00, xdelay=00:00:00, mailer=relay, pri=7303273, relay=[127.0.0.1]$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kc005244: from=<>, size=1423882, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kd005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5F453Ge021414: to=postmaster, delay=2+23:00:00, xdelay=00:00:00, mailer=relay, pri=7841497, relay=[127.0.0.1]$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kd005244: from=<>, size=1422106, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353ke005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5E753Ge014789: to=root, delay=3+20:00:01, xdelay=00:00:00, mailer=relay, pri=9569749, relay=[127.0.0.1], dsn=$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353ke005244: from=<>, size=1260452, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kf005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5E953Ge021513: to=postmaster, delay=3+18:00:00, xdelay=00:00:00, mailer=relay, pri=9604315, relay=[127.0.0.1]$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kf005244: from=<>, size=1474922, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kg005244: Milter: from=<root@freepbx.svr>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5E2pFQa032369: to=root, ctladdr=root (0/0), delay=4+00:18:49, xdelay=00:00:00, mailer=relay, pri=10018484, re$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kg005244: from=<root@freepbx.svr>, size=1258725, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kh005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5E453Ge004665: to=postmaster, delay=3+23:00:00, xdelay=00:00:00, mailer=relay, pri=10052547, relay=[127.0.0.1$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kh005244: from=<>, size=1473154, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353ki005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5E953Gf021513: to=postmaster, delay=3+18:00:00, xdelay=00:00:00, mailer=relay, pri=10427373, relay=[127.0.0.1$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353ki005244: from=<>, size=2297980, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kj005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5E553Ge008016: to=postmaster, delay=3+22:00:00, xdelay=00:00:00, mailer=relay, pri=10785598, relay=[127.0.0.1$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kj005244: from=<>, size=2296205, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kk005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5D953Ge004531: to=postmaster, delay=4+18:00:00, xdelay=00:00:00, mailer=relay, pri=14254596, relay=[127.0.0.1$
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kk005244: from=<>, size=3965203, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kl005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5D353Ge016888: to=postmaster, delay=5+00:00:00, xdelay=00:00:00, mailer=relay, pri=14792820, relay=[127.0.0.1$
Jun 18 04:10:04 freepbx sm-msp-queue[5241]: v5D353Ge016888: v5I353Ge005241: return to sender: Cannot send message for 5 days
Jun 18 04:10:05 freepbx sendmail[5244]: v5I353kl005244: from=<>, size=3963427, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:05 freepbx sendmail[5244]: v5I353km005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Jun 18 04:10:05 freepbx sm-msp-queue[5241]: v5I353Ge005241: to=postmaster, delay=00:00:01, xdelay=00:00:00, mailer=relay, pri=3994451, relay=[127.0.0.1], $
Jun 18 04:10:05 freepbx sendmail[5244]: v5I353km005244: from=<>, size=3964451, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 18 04:10:06 freepbx mimedefang[13307]: v5I353kZ005244: smfi_chgheader returned MI_FAILURE
Jun 18 04:10:06 freepbx mimedefang[13307]: v5I353kZ005244: smfi_addheader returned MI_FAILURE
this has been going on for weeks and I'm baffled as to how to resolve it. I'm running spamassassin and mimedefang but I don't know if they are connected to causing this. If I do mailq it says '/var/spool/mqueue is empty Total requests: 0'. A search on google doesn't bring up anything I can work with. Thanks for any help.
 
Old 06-19-2017, 06:33 AM   #2
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,841

Rep: Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868
Quote:
Every hour - at exactly 10 min and 4 secs past - my maillog is showing this:
A cronjob? What gives?
Code:
crontab -l

Quote:
Jun 18 04:10:04 freepbx sendmail[5244]: v5I353kb005244: Milter: from=<>, reject=451 4.3.2 Please try again later
Usually a <> from address means that this is a bounce or a DSN message. You (assuming you're the root) can read these emails and identify what this is about. Maybe a (big) cronjob output.


Quote:
Jun 18 04:10:06 freepbx mimedefang[13307]: v5I353kZ005244: smfi_chgheader returned MI_FAILURE
Jun 18 04:10:06 freepbx mimedefang[13307]: v5I353kZ005244: smfi_addheader returned MI_FAILURE
You can give this a try and see if it helps

Regards

Last edited by bathory; 06-19-2017 at 06:52 AM.
 
Old 06-20-2017, 03:10 AM   #3
tonj
Member
 
Registered: Sep 2008
Posts: 521

Original Poster
Rep: Reputation: 37
thanks for your response bathory. contab -l gives nothing, the cursor just drops to the next line. As regards the INPUT_MAIL_FILTER from the link you gave, this is my current setting in sendmail.mc:
INPUT_MAIL_FILTER(`mimedefang', `S=unix:/var/spool/MIMEDefang/mimedefang.sock, F=T, T=S:5m;R:5m')
do I need to change both settings to 15m or just one of them?
 
Old 06-20-2017, 04:47 AM   #4
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,841

Rep: Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868
Quote:
contab -l gives nothing, the cursor just drops to the next line.
If something is repeated every one hour, then it should be a cronjob. Since it's not a root cronjob then it's most likely sa1 that collects system information (run by default every hour +10m for RHEL).
Maybe there is a problem with that script, so once again you need to read the mail sent to root/postmaster to find the reason of it.


Quote:
As regards the INPUT_MAIL_FILTER from the link you gave, this is my current setting in sendmail.mc:
INPUT_MAIL_FILTER(`mimedefang', `S=unix:/var/spool/MIMEDefang/mimedefang.sock, F=T, T=S:5m;R:5m')
do I need to change both settings to 15m or just one of them?
From what I've read you should increase both values.
 
Old 06-20-2017, 09:21 AM   #5
tonj
Member
 
Registered: Sep 2008
Posts: 521

Original Poster
Rep: Reputation: 37
Quote:
Originally Posted by bathory View Post
it's most likely sa1
what's sa1?
 
Old 06-20-2017, 03:12 PM   #6
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,841

Rep: Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868
Quote:
Originally Posted by tonj View Post
what's sa1?
From the manpage:
Quote:
sa1 - Collect and store binary data in the system activity daily data file

The sa1 command is a shell procedure variant of the sadc command and handles all of the flags and parameters of that command. The sa1 command collects and stores binary data in the /var/log/sa/sadd file, where the dd parameter indicates the current day. The interval and count parameters specify that the record should be written count times at interval seconds. If you do not specify these parameters, a single record is written.
The sa1 command is designed to be started automatically by the cron command.
 
Old 06-21-2017, 03:14 AM   #7
tonj
Member
 
Registered: Sep 2008
Posts: 521

Original Poster
Rep: Reputation: 37
Quote:
you need to read the mail sent to root/postmaster to find the reason of it
this makes sense, but if it's from=<> how do I know who's sending it? Above you said
Quote:
Usually a <> from address means that this is a bounce or a DSN message. You (assuming you're the root) can read these emails and identify what this is about.
Yes I do have root access and I've been into /var/spool/mail but can't see any evidence of who's sending, I can't see these emails and the mailq command still says that spool is empty. Each line also contains to=postmaster but in /var/spool/log there is no postmaster entry and I've done a search on the machine for postmaster and there's nothing. I do appreciate any further ideas....

edit: I've just gone into /var/spool/mqueue and there's a file in there called dfu4HFIx9L029021 and it's huge:
Quote:
# ls -l dfu4HFIx9L029021
-rw------- 1 root smmsp 553316352 May 17 2016 dfu4HFIx9L029021
that's 550Mb. And I still have my logwatch logs for 2016 and the log for 16/5/2017 was okay and after that date the sendmail section went crazy with massive amounts of data recorded. I think I'm getting close. Should I just delete this file? and maybe watch it if it starts growing again?
 
Old 06-21-2017, 04:21 AM   #8
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,841

Rep: Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868
Quote:
Yes I do have root access and I've been into /var/spool/mail but can't see any evidence of who's sending, I can't see these emails and the mailq command still says that spool is empty. Each line also contains to=postmaster but in /var/spool/log there is no postmaster entry and I've done a search on the machine for postmaster and there's nothing. I do appreciate any further ideas....
I've told you that (most of the times) postmaster is aliased to root. So use the mail command to read root's mail.


Quote:
edit: I've just gone into /var/spool/mqueue and there's a file in there called dfu4HFIx9L029021 and it's huge:
Quote:
# ls -l dfu4HFIx9L029021
-rw------- 1 root smmsp 553316352 May 17 2016 dfu4HFIx9L029021
that's 550Mb. And I still have my logwatch logs for 2016 and the log for 16/5/2017 was okay and after that date the sendmail section went crazy with massive amounts of data recorded. I think I'm getting close. Should I just delete this file? and maybe watch it if it starts growing again?
It won't grow. It's the data-file of a mail in queue at that time, but it misses its control-file (there should be also a qfu4HFIx9L029021 file), so it can't be sent.
Give it a look to see if it contains something useful and then you can delete it, or move it to some other place.
 
Old 06-25-2017, 03:36 AM   #9
tonj
Member
 
Registered: Sep 2008
Posts: 521

Original Poster
Rep: Reputation: 37
I deleted dfu4HFIx9L029021 but it made no difference, the original problem persists. I'm sorry to ask such a silly question but what is the mail command to read root's mail?
 
Old 06-25-2017, 08:05 AM   #10
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,841

Rep: Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868
Quote:
Originally Posted by tonj View Post
I deleted dfu4HFIx9L029021 but it made no difference, the original problem persists. I'm sorry to ask such a silly question but what is the mail command to read root's mail?
Told you it won't make any difference, but you should have try to read it and see what it was about. Perhaps it was something important.

Anyway, to read root's mail, you (logged-in as root of course) can use mutt or pine (alpine), whatever is installed in your distro. You can install any of them if they are not installed.
Or you can use the simple mail command, that comes with all distros. See this video for its usage

Regards
 
Old 06-25-2017, 09:19 AM   #11
tonj
Member
 
Registered: Sep 2008
Posts: 521

Original Poster
Rep: Reputation: 37
thanks for the video link but I get:
Quote:
# mail -u root
No mail for root
I also listed all users with this command: cut -d: -f1 /etc/passwd and I went through most users in the list using mail -u <user> and none of them had mail either. Thanks for any further ideas.
 
Old 06-25-2017, 11:16 AM   #12
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,841

Rep: Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868
Quote:
Originally Posted by tonj View Post
thanks for the video link but I get:

I also listed all users with this command: cut -d: -f1 /etc/passwd and I went through most users in the list using mail -u <user> and none of them had mail either. Thanks for any further ideas.
Doh, there should mail, either in the spool or the queue directory


As for other ideas...

Did you increase the mimedefang timeouts in sendmail.mc as posted in post #2 and test again? You didn't say anything about it. Of course you need to rebuild sendmail.cf afterwards and restart the sendmail service?

Disable sa1 and see if that's the culprit. For this you need to edit /etc/cron.d/sysstat and add a # in front of the sa1 line, like:
Code:
#*/10 * * * * root /usr/lib64/sa/sa1 1 1
 
Old 07-12-2017, 03:12 AM   #13
tonj
Member
 
Registered: Sep 2008
Posts: 521

Original Poster
Rep: Reputation: 37
yes I did increase the mimedefang timeouts and I did rebuild sendmail (I did m4 sendmail.mc >sendmail.cf for that) but it made no difference. What i did try was switching off both mimedefang and spamassassin for a couple of days, it meant putting up with spam but the traffic processed by sendmail went down to <5mb a day which is about 10th of what it was. So something internal is trying to send mail to root but is getting blocked by spamassassin, I still don't know what it is. Thanks for your suggestion above but there is no /etc/cron.d/sysstat file on my machine. Appreciate any further ideas.
 
Old 07-12-2017, 06:15 AM   #14
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,841

Rep: Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868Reputation: 1868
Quote:
So something internal is trying to send mail to root but is getting blocked by spamassassin, I still don't know what it is
Cronjob of sa1?


Quote:
there is no /etc/cron.d/sysstat file on my machine
I thought that your distro (SHMZ release 6.5 (Final)), has the same system cronjobs as Centos, because it's based on it.
Anyway search under /etc/cron.d/ or any other directory from where cronjobs start in your distro, to find which one runs sa1 cron.
 
Old 07-12-2017, 09:03 AM   #15
tonj
Member
 
Registered: Sep 2008
Posts: 521

Original Poster
Rep: Reputation: 37
I also thought my OS was based on centos, and to make it worse I've searched and there is no 'sa1' anywhere in the etc/cron folders.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Does spamass-milter only reject based on whole-number scores? mfoley Linux - Server 1 03-13-2017 03:20 PM
Starting spf-milter: spf-milter: Milter for 'spf-milter' not found in /etc/mail/sendm Niceman2005 Linux - Software 1 07-06-2009 03:07 AM
reject=451 sendmail spooge Linux - Networking 1 06-19-2007 11:20 PM
fetchmail - How to delete mails with sendmail 451 reject MQMan Linux - Networking 4 02-05-2007 10:52 AM
bm-milter and sendmail Ammad Linux - Networking 1 11-23-2006 09:40 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 02:25 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration