email forwarding locally consumes all resources

[rdells]

FC4 - perfect suetup....
Hi folks, all works great until I try to forward email to many same domain email addresses. IE: We have an email address that is used to forward the same message to all employees (from the boss to employees, the boss sends 1 email to the "staff@... email address, which in-turn forwards a copy of that email to 25+ employees).

I was using the actual email address to forward to (25+ email addresses) and the first time, it crashed the computer! The second time around, I did forwarding to 1 user, IE: web1_user1@localhost. This worked ok.

I then did all 25 web1_@localhost and all the computer resources got consumed, it did not crash however, however2- it took about 15 minutes to deliver all the same 25 emails!...

Email forwarding seems ok when forwarding to email on another server.

Tested some more:
1) forwards fine (5 email addreses) to other email server with minimal resource usage.
2) sending email to just 1 local email from 1 local email (just 1 email) system jumps to 100% cpu usage...

Thanks in advance for any input,
Robert

[till]

Originally Posted by rdells

I was using the actual email address to forward to (25+ email addresses) and the first time, it crashed the computer! The second time around, I did forwarding to 1 user, IE: web1_user1@localhost. This worked ok.

Have you tried the email addresses of the users as destination, not their usernames. e.g. tom.smith@companydomain.com and nit web1_tom@localhost.

[rdells]

Yes, I tried delivering to:
1) tom.smith@companydomain.com
2) web1_tom.smith@companydomain.com
3) web1_tom.smith@localhost
from: Ie: jon.doh@companydomain.com
all 3 get delivered, however cpu load jumps to 100%.

Under any of these scenarios, cpu load barely changes:
FROM: web1_tom.smith@companydomain.com
or FROM: tom.smith@companydomain.com
TO: me@differentmailserver.com
FROM: me@differentmailserver.com
TO: web1_tom.smith@companydomain.com
or TO: tom.smith@companydomain.com

Seems only when sending emails between local accounts, Ie: from one employee to another employee of the same domain.

(I only have 1 domain setup, so I have not tried one local domain to another local domain)

Thanks, need a maillog posted?
Robert

[falko]

Yes, please post an excerpt of your mail log.

[rdells]

I am trying to get some of the log.
the obvious (to me) on the mail log is the entries of:

"ipop3d[1728]: Mailbox volnerable - directory /var/spool/mail must have 1777 protection."

Is this normal for maillog??

I did some more testing, on one email account:
ON: mailscan, antivirus, spamfilter: cpu jump at 100%
ON: mailscan, antivirus: cpu jump at 30%
OFF: mailscan, antivirus, spamfilter: cpu jump at 30%
Seems as though spamfilter is very intense!

Is this normal behavior for spam filter?

The Server is 800Mhz with Raid1, 256Mb Ram, Only one website.
Maybe I need more power to run the spamfilter and antivirus?

Thanks, will try and get the log for you....it's getting very large...gedit keeps crashing(I have desktop installed to help my 'rookie-ness').

*********
Ok, heres the maillog:
The server = server1.myserver.tld (made this up)
Workstation Router = 11.11.11.11 (made this up)
I sent 1 plain txt email
I recieved the same 1 plain txt email, plus another email

Feb 15 12:58:59 server1 postfix/smtpd[20615]: connect from unknown[11.11.11.11]
Feb 15 12:58:59 server1 postfix/smtpd[20615]: 30D093205FD: client=unknown[11.11.11.11], sasl_method=LOGIN, sasl_username=web1_info
Feb 15 12:58:59 server1 postfix/cleanup[20592]: 30D093205FD: message-id=<019a01c63268$c9965ce0$6501a8c0@epm002>
Feb 15 12:58:59 server1 postfix/qmgr[2453]: 30D093205FD: from=<info@pmfsd.com>, size=615, nrcpt=1 (queue active)
Feb 15 12:58:59 server1 postfix/smtpd[20615]: disconnect from unknown[11.11.11.11]
Feb 15 12:58:59 server1 sendmail[20682]: k1FKwx2i020682: from=web1_admin, size=116, class=0, nrcpts=1, msgid=<200602152058.k1FKwx2i020682@server1.myserve r.tld>, relay=web1_admin@localhost
Feb 15 12:58:59 server1 postfix/smtpd[20564]: connect from server1.myserver.tld[127.0.0.1]
Feb 15 12:58:59 server1 postfix/smtpd[20564]: setting up TLS connection from server1.myserver.tld[127.0.0.1]
Feb 15 12:58:59 server1 postfix/smtpd[20564]: TLS connection established from server1.myserver.tld[127.0.0.1]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Feb 15 12:58:59 server1 sendmail[20682]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256
Feb 15 12:58:59 server1 postfix/smtpd[20564]: A30FB320608: client=server1.myserver.tld[127.0.0.1], sasl_sender=web1_admin@server1.myserver.tld
Feb 15 12:58:59 server1 postfix/cleanup[20592]: A30FB320608: message-id=<200602152058.k1FKwx2i020682@server1.myserver.t ld>
Feb 15 12:58:59 server1 postfix/qmgr[2453]: A30FB320608: from=<web1_admin@server1.myserver.tld>, size=796, nrcpt=1 (queue active)
Feb 15 12:58:59 server1 sendmail[20682]: k1FKwx2i020682: to=admispconfig@localhost, ctladdr=web1_admin (10039/10001), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30116, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (Ok: queued as A30FB320608)
Feb 15 12:58:59 server1 postfix/smtpd[20564]: disconnect from server1.myserver.tld[127.0.0.1]
Feb 15 12:58:59 server1 postfix/local[20616]: 30D093205FD: to=<web1_admin@server1.myserver.tld>, orig_to=<pmfsd.admin@pmfsd.com>, relay=local, delay=0, status=sent (delivered to command: /usr/bin/procmail -f-)
Feb 15 12:58:59 server1 postfix/qmgr[2453]: 30D093205FD: removed
Feb 15 12:58:59 server1 postfix/local[20595]: A30FB320608: to=<admispconfig@server1.myserver.tld>, relay=local, delay=0, status=sent (delivered to command: /usr/bin/procmail -f-)
Feb 15 12:58:59 server1 postfix/qmgr[2453]: A30FB320608: removed
Feb 15 12:59:07 server1 ipop3d[20709]: pop3 service init from 11.11.11.11
Feb 15 12:59:08 server1 ipop3d[20709]: Mailbox vulnerable - directory /var/spool/mail must have 1777 protection
Feb 15 12:59:08 server1 ipop3d[20709]: Login user=web1_admin host=[11.11.11.11] nmsgs=2/2
Feb 15 12:59:08 server1 ipop3d[20709]: Mailbox vulnerable - directory /var/spool/mail must have 1777 protection
Feb 15 12:59:08 server1 ipop3d[20709]: Logout user=web1_admin host=[11.11.11.11] nmsgs=0 ndele=2

[falko]

Can't find anything suspicious in there.
What's the output of

/home/admispconfig/ispconfig/tools/spamassassin/usr/bin/spamassassin -V

?

You can run

top

to track down the resource-hungry processes.

Feb 15 12:59:08 server1 ipop3d[20709]: Mailbox vulnerable - directory /var/spool/mail must have 1777 protection

Run

chmod 1777 /var/spool/mail

[rdells]

Thanks for that info:

ran: /home/admispconfig/ispconfig/tools/spamassassin/usr/bin/spamassassin -V
SpanAssassin version 3.1.0
running on Perl version 5.8.6

ran top:
Only hungry processes:
web1_usersname(getting the email): cpu @ 55% when spamfilter is ON, server receiving email
postfix(getting the email): cpu @ 5% when spamfilter is OFF, server receiving email

I turned off the spamfilter on all the accounts for now(except the one I am testing with). Having the antivirus turned on seems good(cannot tell that it's running, and it is working).
Robert

[falko]

Can you post the output of

uname -m

?

[rdells]

Here you go:
i686

[falko]

That's ok, too.
You can try to compile SpamAssassin yourself on your system - maybe your system doesn't like the one that comes with ISPConfig. This is how you do it:

tar xvfz Mail-SpamAssassin-3.1.0.tar.gz
cd Mail-SpamAssassin-3.1.0
perl Makefile.PL PREFIX=/home/admispconfig/ispconfig/tools/spamassassin/usr SYSCONFDIR=/home/admispconfig/ispconfig/tools/spamassassin/etc
make
make install