[RESOLVED] Mail server stops sending and receiving emails

Discussion in 'ISPConfig 3 Priority Support' started by curiousadmin, May 21, 2019.

  1. curiousadmin

    curiousadmin New Member HowtoForge Supporter

    EDIT: [RESOLVED] Server did not have enough memory to handle the antivirus system - see the thread for details.
    TL;DR: DO NOT operate ISPConfig 3 on server with less than 2 GB of RAM and 2 GB swap.

    Hello Team,
    I have installed my server some years ago using this howto:
    https://www.howtoforge.com/tutorial...ix-dovecot-mysql-phpmyadmin-rkhunter-binutils
    The server itself is actually Debian 8.11

    I think it's it's irrelevant but let me say that for emails I use Thunderbird with SOCKS5 proxy set to 127.0.0.1 - the proxy itself is fine as emails sent via servers other than server1.mydomain.com work fine. I don't use TOR or any other frowned upon network as SOCKS5 proxy.

    The issue:
    My server suddenly stops receiving emails - at this point I can't be sure if it's really 100% of them but it was at least 90%.
    From the 3rd party the sent email looks like this (this is what they received after couple of days since they sent the email):
    Subject: Undelivered Mail Returned to Sender
    Body:
    Temporary fix:
    Reboot of the server.
    If I reboot the server the emails that could not be delivered and are in queue at the 3rd party servers (I assume) and are eventually coming through over the next couple of hours.

    What I checked:
    Disk space and host utilization.
    Server has gigabytes of SSD space available and there is enough RAM as well as space in swap available, CPU utilization is low.

    What I also noticed:
    It seems that the issue goes both ways - at least in one case a sent email from server1.mydomain.com has been also bounced by Gmail, however this might be caused by reputation downgraded by some blacklists as my emails were bouncing (checked with mxtoolbox.com - the server IP already made it to the blacklist for reason of too many bounced emails):
    Subject: Undelivered Mail Returned to Sender
    Body:
    This issue has already happened maybe 3 months ago but I did the reboot and forgot about the issue now the issue is back :(
    I really don't know what to check or how to even diagnose this.
    Thank you very much in advance for any help.
     
    Last edited: Jun 19, 2019
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    The error '127.0.0.1[127.0.0.1]:10024: Connection refused' means that amavisd-new stopped working. Restart amavisd.
     
  3. curiousadmin

    curiousadmin New Member HowtoForge Supporter

    Is there any way to monitor for this or to auto-restart the service? Would removal of amavisd also disable the antispam or only the antivirus?
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Try to find in mail.log and the Linux syslog which errors occur to find the reason why amavis stops.

    You can use the programs munin and monit o monitor your system closely and restart services when required.

    That's not really an option as you would use antivirus, antispam functions and the ability to sign emails with DKIM.
     
  5. curiousadmin

    curiousadmin New Member HowtoForge Supporter

    Can you please guide me what am I exactly looking for?
    I suppose once I start seeing in the mail.log the following:
    Code:
    Jun 18 06:16:06 server1 postfix/smtp[3542]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused
    (1) Then it's already broken - correct? But what shall I see beforehand?
    (2) And am I looking for it in the mail.log or syslog?
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    1) Yes, when you see this, then amavis is stopped already.
    2) I would look in both, but more likely is that you find the reason in the syslog. Might be that amavis runs out of memory or something similar.
     
  7. curiousadmin

    curiousadmin New Member HowtoForge Supporter

    ok in syslog I found the following:
    Code:
    Jun 18 06:09:30 server1 amavis[1750]: (!)Net::Server: 2019/06/18-06:09:30 Bad fork [Cannot allocate memory]\n  at line 145 in file /usr/share/perl5/Net/Server/PreForkSimple.pm
    I suppose that's the error we are looking for?

    The truth is the server is RAM starved - it has only 1 GB of RAM but it has 2 GB in swap which AFAIK is not full. Is there any way to make it work with the swap or just forget it and go ahead with upgrading the RAM?
     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes, that's teh kind of issue I'm looking for. Memory handling is done by the Linux kernel on its's own, it should use swap automatically. I would upgrade RAM, 1GB is just not enough for a full server with mail + web.
     
  9. curiousadmin

    curiousadmin New Member HowtoForge Supporter

    Thank you till - you have been very helpful. I'm going to do the upgrade to 2 GB.
     
  10. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    AFAIK is not good enough. Check how much memory and SWAP is used, for example with
    Code:
    free -h
    
    or monitor with dstat (needs to be installed first)
    Code:
    dstat  --load --mem -s 10 100
    If both RAM and swap are exhausted, you get out of memory errors. Adding swap is easy, make it 4 G or make another 2 G swap in addition to the one you have now, that gives more usable memory.
     

Share This Page