Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : sendmail-8.9.3-C7 issues on raq2/3

[jahsh]

hello, we are experiencing some weird things with our mail on both a raq2 and a raq3. however there isnt much to go on in the logs. we have seen some suspicious entries in our /var/log/maillog however arent too sure where to go from here. If they arent using the formmail scripts to spam what else could be happening. there is definitely something fishy going on because these 2 servers are very sluggish. is there some loophole with this version of sendmail. any info would be greatly appreciated.

[smartbackups]

Do you have the pop before smtp installed on both machines?

When you say sluggish what is the load on them?


When it is sluggish next time ssh/telnet in and do the following command

ps auxw | grep sendmail

see how many processes are running. You also will want to do a top and see wha tis taking all of the resources. Let me know.

[jahsh]

we have tried all of what you said. that is why this is so weird. the load average is very low and there are only one process when i do ps aux |grep sendmail
by sluggish i mean when typing there is a lag time between keystroke response. the connection seems choppy and our customers complain of the same issues. any other ideas, maybe it isnt even sendmail. are there any other known issues with lag time. oh yeah and we have 512k of ram, most of which isnt being used so we have checked that off the list. thanks for any input

[smartbackups]

Have you done multiple traceroutes? Use a place like http://www.geektools.com and see what the traces look like, it could very well just be your provider.
It also could be your connection but since you said customers were experiencing same, it is prollyyour provider or upstream.

What made you think sendmail was the problem?

[jahsh]

just weird entries in our /var/log/mailog file made us suspicious it was mail. we had email addresses coming from and to unknown domains on our servers. its only these 2 servers acting up, we have at least 20 others on the same connection so have pretty much ruled out the connection as well. any other ideas?

[jahsh]

anyone else have any ideas?

[bitserve]

Well if it's not a hardware resource problem, it probably IS a network resource problem.

Traceroute probably is the best way to determine those types of problems. Maybe do some pings to your server's gateway from the server.

For a start, I'd do an ifconfig to see how many errors you have on your network adapters. It's normal to have one an hour during peak times. Anything above that average and you have some network problems, not just resource problems.